MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4
SHA3-384 hash: 47f1d171840e8588e57cdc59c14c8055c45301b937fa0b0df1c5fbf9740327b5ab8a1c5e63462e6f81fb7ebe8ed0b522
SHA1 hash: 81a9713534bfb82b5a66dbd6c629df40f1fe79e5
MD5 hash: bb503cb59416e826e54c606edd10b104
humanhash: nevada-iowa-virginia-red
File name:Request For Quotation.js
Download: download sample
Signature STRRAT
Create hunting rule
File size:795'844 bytes
First seen:2024-09-30 08:25:16 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:HQR2oZA/yOrMb3B2zMCOsUB1q4l3DPZrl7C9PW6BSjlrd3k7HGgjxN+acv/jDinL:wmCq
TLSH T1510538C46E6438069BA7F534D325D123AC38D81B2D9725E27DD47E0DAEB7C402E9DA70
Magika javascript
Reporter abuse_ch
Tags:js STRRAT


Avatar
abuse_ch
STRRAT C2:
45.89.247.199:3608

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.89.247.199:3608 https://threatfox.abuse.ch/ioc/1331918/

Intelligence

File Origin
# of uploads :
1
# of downloads :
414
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
YARA.obfuscated_eval.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66fac44dc85f12c405da6f69
Tags:
Cryxos Emotet Java
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
banload evasive obfuscated obfuscated
Link:
https://www.filescan.io/uploads/66fa609eac7403f51790b534/reports/c1c9103e-a208-406f-b6a0-2eaa6a34b66c/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1522537
Signature
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4/
Threat name:
Script-JS.Trojan.Cryxos
Create hunting rule
Status:
Malicious
First seen:
2024-09-30 08:26:05 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2wxaneypz5n67qmqaktfebeqkwbczp577irlsp7qw3qpfyoom6sa._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat execution persistence stealer trojan
Link:
https://tria.ge/reports/240930-kbvmqazbrb/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Loads dropped DLL
STRRAT
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Base64_Encoded_Hex_Encoded_Code
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects hex encoded code that has been base64 encoded
Reference:https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Rule name:SUSP_Base64_Encoded_Hex_Encoded_Code_RID3420
Create hunting rule
Author:Florian Roth
Description:Detects hex encoded code that has been base64 encoded
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments