MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd46649a44ff5a074bcfdcd75a0d931f3d6a3ced09436209260a732bb4dfafef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 4


Intelligence 4 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd46649a44ff5a074bcfdcd75a0d931f3d6a3ced09436209260a732bb4dfafef
SHA3-384 hash: 2879e6c6047f09d5b53177c1487156e0e556e8f9a5bc5f457e3c4c4bccc2b108e59c569edadcabc9ba4657a99343ba17
SHA1 hash: 3118519521a693e40828363b4e32d14f5d7dd43b
MD5 hash: c0562cf2c8cfd2c1040bff6dc1a85188
humanhash: moon-glucose-oregon-hotel
File name:dhl paket.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:174'548 bytes
First seen:2021-09-25 20:16:04 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:v+kxvk4S8Q4OMluJLmQQo01lSEL3OpL6hILNDvvjymE+qMnYd8IUduZ8X6x9g:vJFvBlGLmQPELZqLNDvOmXxMU8Kqxm
TLSH T18404130F1C29F2D5B4B420A4D75B0F818DF597EA1D83CBB8862B44DE78E45A013E56DB
Reporter neoxmorpheus1
Tags:jar STRRAT

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.140.53.207:1506 https://threatfox.abuse.ch/ioc/226716/

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dhl paket.jar
Verdict:
No threats detected
Analysis date:
2021-09-25 20:21:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d2fc3dcb-6053-4959-a496-3d5e98a2898a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191604/
Detection(s):
SecuriteInfo.com.Java.Trojan.GenericGBA.30616.24477.16139.UNOFFICIAL
Create hunting rule

Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/858130
Signature
Exploit detected, runtime environment starts unknown processes
Multi AV Scanner detection for domain / URL
Sigma detected: WScript or CScript Dropper
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 490561 Sample: dhl paket.jar Startdate: 25/09/2021 Architecture: WINDOWS Score: 68 27 sonatype.map.fastly.net 2->27 29 repo1.maven.org 2->29 31 github.com 2->31 39 Multi AV Scanner detection for domain / URL 2->39 41 Yara detected STRRAT 2->41 43 Exploit detected, runtime environment starts unknown processes 2->43 45 2 other signatures 2->45 9 cmd.exe 2 2->9         started        signatures3 process4 process5 11 java.exe 6 9->11         started        14 conhost.exe 9->14         started        file6 25 C:\Users\user\ojbzebnmss.js, ASCII 11->25 dropped 16 wscript.exe 2 11->16         started        18 icacls.exe 1 11->18         started        process7 process8 20 javaw.exe 21 16->20         started        23 conhost.exe 18->23         started        dnsIp9 33 github.com 140.82.121.3, 443, 49752, 49756 GITHUBUS United States 20->33 35 140.82.121.4, 443, 49795, 49807 GITHUBUS United States 20->35 37 3 other IPs or domains 20->37
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd46649a44ff5a074bcfdcd75a0d931f3d6a3ced09436209260a732bb4dfafef/
Threat name:
ByteCode-JAVA.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2021-09-25 20:17:07 UTC
AV detection:
13 of 45 (28.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvdgjgse75naos6p3tlvudmtd46wuphnbfbwecjgbjzsxng7v7xq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210925-y2p2tadgh7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/cd46649a44ff5a074bcfdcd75a0d931f3d6a3ced09436209260a732bb4dfafef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/191604/

Comments