MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7c07eaf70e4232c955685c98426fcf756aa2ed3e0b7173537fafef1d2a5dde2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7c07eaf70e4232c955685c98426fcf756aa2ed3e0b7173537fafef1d2a5dde2
SHA3-384 hash: a89653cb09b1d6eb9b4c5a59d876b6e72a835330099954953d557f1686179f2535c3a8482eb13e348666f431c31baddc
SHA1 hash: b18b08e7b9b26eace4863509efecd2cff833efa0
MD5 hash: 5db79c866aa8b9f81acd72da5f8d3c34
humanhash: fourteen-chicken-lactose-mike
File name:RFQ MI-RE-1204-22 133722.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:175'556 bytes
First seen:2022-04-14 19:56:21 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:DIjNlX3Eb6E++oOKVpkqcJODtiQN22o1r6yRFG3cblV573Nis:Q/a6eKgJrQN2523cvpH
TLSH T13204F13BFEA984F0F40B593100299671EB0C12ECD686942B69FD5CA92974D7E0F468CF
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
194.5.97.4:7888

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.5.97.4:7888 https://threatfox.abuse.ch/ioc/519947/

Intelligence

File Origin
# of uploads :
1
# of downloads :
403
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
strrat
Create hunting rule
ID:
1
File name:
RFQ MI-RE-1204-22 133722.jar
Verdict:
Malicious activity
Analysis date:
2022-04-14 20:28:01 UTC
Tags:
evasion trojan strrat rat
Link:
https://app.any.run/tasks/a22f92f6-27dc-41ae-bbbd-32180bb7c580

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/263850/
Detection(s):
Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62587c76482f2f41cab02742/reports/ad287adb-6354-41e5-9d4f-949ee1ee0cf2/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c7c07eaf70e4232c955685c98426fcf756aa2ed3e0b7173537fafef1d2a5dde2
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/977151
Signature
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 609640 Sample: RFQ MI-RE-1204-22 133722.jar Startdate: 14/04/2022 Architecture: WINDOWS Score: 64 25 Found malware configuration 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected STRRAT 2->29 8 cmd.exe 2 2->8         started        10 cmd.exe 1 2->10         started        process3 process4 12 java.exe 5 8->12         started        15 conhost.exe 8->15         started        17 7za.exe 75 10->17         started        dnsIp5 23 192.168.2.1 unknown unknown 12->23 19 icacls.exe 1 12->19         started        process6 process7 21 conhost.exe 19->21         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7c07eaf70e4232c955685c98426fcf756aa2ed3e0b7173537fafef1d2a5dde2/
Threat name:
ByteCode-JAVA.Trojan.StrRat
Create hunting rule
Status:
Malicious
First seen:
2022-04-14 17:07:36 UTC
File Type:
Binary (Archive)
Extracted files:
70
AV detection:
14 of 41 (34.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y7ah5l3q4qrszfkwqxeyijx465lkulwt4c3ronjx7l7pduvf3xra._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat persistence stealer trojan
Link:
https://tria.ge/reports/220414-yn88jadfgn/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Adds Run key to start application
Drops startup file
STRRAT
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/c7c07eaf70e4232c955685c98426fcf756aa2ed3e0b7173537fafef1d2a5dde2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263850/

Comments