MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbf6df284ec8dde835dbf3c6ea982e26f021c14dea6541070cccb5fa977c2bca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbf6df284ec8dde835dbf3c6ea982e26f021c14dea6541070cccb5fa977c2bca
SHA3-384 hash: eca63fdab3e8f06015c115c437aa3d3838685a039d41f6e65bffc9a8e6d7c0b1dea3efa53b13344e770d1728e30390da
SHA1 hash: 300aaf652645be064ea359917014f91ac2a0bfc7
MD5 hash: 14473a3e9a3505898b41615d44dfa8f9
humanhash: arkansas-october-mountain-maryland
File name:swift copy of payment.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:344'525 bytes
First seen:2024-03-17 16:40:13 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 6144:MDQWvTDFnK7X2UpQ9yO2eaQnsxLslRqfnZQy0bIEZduj5:kQWbDFgiRn+afIEZMj5
TLSH T1E274125F7BDED0FAD013627222120271EB2C46E5D244542FA6ED3A498E37D88C756ECB
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
23.106.121.133:3232

Intelligence

File Origin
# of uploads :
1
# of downloads :
375
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
strrat
Create hunting rule
ID:
1
File name:
bbf6df284ec8dde835dbf3c6ea982e26f021c14dea6541070cccb5fa977c2bca.jar
Verdict:
Malicious activity
Analysis date:
2024-03-17 16:43:07 UTC
Tags:
rat strrat evasion remote
Link:
https://app.any.run/tasks/14bb851f-0016-45b7-a26d-ffd10b1fc0d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Java.Packer.Allatori-1
Create hunting rule

Sanesecurity.Malware.27013.JsHeur.Obfs.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/65f71d1f5cd908a33db68f90/reports/ebb52a32-9ccb-43ce-b099-ac279d8fe392/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/bbf6df284ec8dde835dbf3c6ea982e26f021c14dea6541070cccb5fa977c2bca
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.expl
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1410438
Signature
Antivirus detection for URL or domain
Exploit detected, runtime environment starts unknown processes
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1410438 Sample: swift copy of payment.jar Startdate: 17/03/2024 Architecture: WINDOWS Score: 96 19 Multi AV Scanner detection for domain / URL 2->19 21 Found malware configuration 2->21 23 Malicious sample detected (through community Yara rule) 2->23 25 5 other signatures 2->25 7 java.exe 9 2->7         started        9 7za.exe 86 2->9         started        process3 process4 11 icacls.exe 1 7->11         started        13 conhost.exe 7->13         started        15 conhost.exe 9->15         started        process5 17 conhost.exe 11->17         started       
Score:
1%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/bbf6df284ec8dde835dbf3c6ea982e26f021c14dea6541070cccb5fa977c2bca
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbf6df284ec8dde835dbf3c6ea982e26f021c14dea6541070cccb5fa977c2bca/
Threat name:
ByteCode-JAVA.Trojan.StrRat
Create hunting rule
Status:
Malicious
First seen:
2024-03-17 15:50:55 UTC
File Type:
Binary (Archive)
Extracted files:
79
AV detection:
16 of 37 (43.24%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xp3n6kcozdo6qno36pdovgboe3ycdqkn5jsucbymzs27vf34fpfa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/240317-t6321saf25/
Behaviour
Suspicious use of WriteProcessMemory
Modifies file permissions
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bbf6df284ec8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
STRRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bbf6df284ec8dde835dbf3c6ea982e26f021c14dea6541070cccb5fa977c2bca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments