MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce2926a742ec5cce7c0d034245d8b0ec39aba2d3894ee45d1562da3ccbb0f91e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 4


Intelligence 4 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce2926a742ec5cce7c0d034245d8b0ec39aba2d3894ee45d1562da3ccbb0f91e
SHA3-384 hash: 6a9e0d76cce7bf316af12d01f265ff15321bfbed5f6c4e85987c94e31b2a3a53e9437b2cf0cc63d890ab45c048f110e0
SHA1 hash: 72f2ba89f4eb11ebd82fe36691798239c542bdad
MD5 hash: 2cd79f99590924965b201e52d2563c04
humanhash: harry-washington-nitrogen-august
File name:New PO- 4201400552.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:181'075 bytes
First seen:2022-03-07 11:51:11 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:1Mma1J1dQoPUiYMj/PesiALULD0zKPSq5PiJKxWKXTveA1DalqggchOPwp4ar+E0:fyvKoPUiY9nHIKpOK849RUxgchOPw+Co
TLSH T1D504238DC5F1A6E1D6A1ED36452927E9C2048F68CD63A9D8F062FC9498062B5CC7C37F
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
172.111.141.64:8088

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.111.141.64:8088 https://threatfox.abuse.ch/ioc/392808/

Intelligence

File Origin
# of uploads :
1
# of downloads :
309
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/247896/
Detection(s):
SecuriteInfo.com.JS.Muldrop.756.1188.13588.UNOFFICIAL
Create hunting rule

Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/951768
Signature
Exploit detected, runtime environment starts unknown processes
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Shells Spawn by Java
Sigma detected: WScript or CScript Dropper
Uses regedit.exe to modify the Windows registry
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 584249 Sample: New PO-  4201400552.jar Startdate: 07/03/2022 Architecture: WINDOWS Score: 92 35 sonatype.map.fastly.net 2->35 37 repo1.maven.org 2->37 39 github.com 2->39 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 5 other signatures 2->55 9 cmd.exe 2 2->9         started        signatures3 process4 process5 11 java.exe 6 9->11         started        14 conhost.exe 9->14         started        file6 33 C:\Users\user\proajityav.js, ASCII 11->33 dropped 16 wscript.exe 3 3 11->16         started        20 icacls.exe 1 11->20         started        process7 file8 29 C:\Users\user\AppData\Roaming\scidfjvb.txt, Zip 16->29 dropped 31 C:\Users\user\...\ebgeaegdbdecaedfebace.reg, ASCII 16->31 dropped 47 Uses regedit.exe to modify the Windows registry 16->47 22 javaw.exe 21 16->22         started        25 regedit.exe 16->25         started        27 conhost.exe 20->27         started        signatures9 process10 dnsIp11 41 github.com 140.82.121.3, 443, 49746, 49752 GITHUBUS United States 22->41 43 140.82.121.4, 443, 49771, 49785 GITHUBUS United States 22->43 45 3 other IPs or domains 22->45
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce2926a742ec5cce7c0d034245d8b0ec39aba2d3894ee45d1562da3ccbb0f91e/
Threat name:
Script-JS.Downloader.Nemucod
Create hunting rule
Status:
Malicious
First seen:
2022-03-07 11:52:06 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
13 of 27 (48.15%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zyusnj2c5rom47ananbelwfq5q42xiwtrfhoixivmlndzs5q7epa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220307-n1qxlsebb8/
Behaviour
Modifies registry class
Runs .reg file with regedit
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/ce2926a742ec5cce7c0d034245d8b0ec39aba2d3894ee45d1562da3ccbb0f91e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/247896/

Comments