MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2
SHA3-384 hash: caf6431858ac7caf97c6d1af03fb06daf9f01d98a18c42e289a6b74bc94d1628b684f098c134efc6f32fe0b3beb37f1f
SHA1 hash: d9d2945053aab6d20b4154c763780300f867ade9
MD5 hash: 5f73f282fd6efe7a9c426b3782a99483
humanhash: avocado-avocado-lemon-low
File name:07900321100.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:129'940 bytes
First seen:2023-12-09 12:16:53 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 1536:lNI8XP1F0tURwTD9OaEPXs0JJSSk48P+KMm2gpEg0HaoUX1XgP4pRS8fP4HRsMu+:lNRyOPbJ6rJCg0Nd4phfP42MlF/E4
TLSH T188C3D0EB7B9ED1B4D25B5031C450452AAEAD41A8E08E962F24FC94850D38CDD1B27EFF
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter V3n0mStrike
Tags:intertradez.com/oo/07900321100.zip jar STRRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
CL CL
Vendor Threat Intelligence
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/463984/
Detection(s):
PUA.Java.Packer.Allatori-1
Create hunting rule

MiscreantPunch.Jsocket.RAT.11162016.2.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27013.JsHeur.Obfs.UNOFFICIAL
Create hunting rule

Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/65745ac0fa995ae153402aea/reports/28cbe4f0-6eda-444b-960d-ec63e45f84e4/overview
Verdict:
Malicious
Labled as:
JAVA/Strrat.b
Link:
https://www.hybrid-analysis.com/sample/b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.expl
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1356892
Signature
Antivirus detection for URL or domain
Exploit detected, runtime environment starts unknown processes
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1356892 Sample: 07900321100.jar Startdate: 09/12/2023 Architecture: WINDOWS Score: 96 19 Multi AV Scanner detection for domain / URL 2->19 21 Found malware configuration 2->21 23 Malicious sample detected (through community Yara rule) 2->23 25 5 other signatures 2->25 7 java.exe 9 2->7         started        9 7za.exe 86 2->9         started        process3 process4 11 icacls.exe 1 7->11         started        13 conhost.exe 7->13         started        15 conhost.exe 9->15         started        process5 17 conhost.exe 11->17         started       
Score:
1%
Verdict:
Benign
File Type:
Archive
Link:
https://malprob.io/report/b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2/
Threat name:
ByteCode-JAVA.Trojan.Strrat
Create hunting rule
Status:
Malicious
First seen:
2023-12-09 12:17:06 UTC
File Type:
Binary (Archive)
Extracted files:
79
AV detection:
6 of 37 (16.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xdjd3d4usxbrlinhzdnpqkcpqqd7bgd5dnhr2lbiqd5b7rrfokra._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat discovery
Link:
https://tria.ge/reports/231209-pf2daagccq/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Modifies file permissions
Malware Config
C2 Extraction:
lestencrypt.dnset.com:7888
lestencrypt.dnset.com:1780
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

STRRAT

zip 288ff2d664d112c5d94982aee0af7357df33c85649379f8a4c2ae08c13df9cc6

STRRAT

Java file jar b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/463984/
  
Dropped by
SHA256 288ff2d664d112c5d94982aee0af7357df33c85649379f8a4c2ae08c13df9cc6
  
Dropped by
MD5 9d4d7fe5b3307017f98dce21bb142547

Comments