MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fed69483c65124aaa131a3fb4e99508ee0497b7672811349bbe541f541df5362. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fed69483c65124aaa131a3fb4e99508ee0497b7672811349bbe541f541df5362
SHA3-384 hash: a6f2de893ff54bce7f68a6364c2c46b42f80fa943bb45cda9b20f40e393ae2ef5fc3494af69cf6213d6a4e50c0e66af2
SHA1 hash: 80f0949ca74c2b9127070691e1dd67dd82027f54
MD5 hash: 333a9414bf9a3a929bccae9e9e6c31e2
humanhash: chicken-september-august-finch
File name:Urgent Order.js
Download: download sample
Signature STRRAT
Create hunting rule
File size:358'106 bytes
First seen:2023-10-23 06:45:38 UTC
Last seen:2023-10-24 09:14:39 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:rCgNHBY/YrwRjVPL6tzp9eAtDelFpn9JG534vPcV1z7uPmdSmMBpA0Q:u4qYreoUKD4TG9APg3/V
TLSH T121745A0BB9CC0E95BA78600441EFD396E2BD890D641CA44EBF637F1F6E62EC94D12346
Reporter abuse_ch
Tags:js repo1-maven-org STRRAT


Avatar
abuse_ch
STRRAT C2:
79.134.225.103:6725

Intelligence

File Origin
# of uploads :
3
# of downloads :
341
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-gen.28141.7982.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade obfuscated
Link:
https://www.filescan.io/uploads/653616ab58fd0a907339dccb/reports/80a8ba38-5c25-4114-8644-c9fc16b9f1af/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/fed69483c65124aaa131a3fb4e99508ee0497b7672811349bbe541f541df5362
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1330316
Signature
Antivirus detection for URL or domain
Found malware configuration
JavaScript source code contains call to eval containing suspicious API calls
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Uses an obfuscated file name to hide its real file extension (double extension)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ASCII
Link:
https://malprob.io/report/fed69483c65124aaa131a3fb4e99508ee0497b7672811349bbe541f541df5362
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fed69483c65124aaa131a3fb4e99508ee0497b7672811349bbe541f541df5362/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-10-23 02:57:35 UTC
File Type:
Text (JavaScript)
AV detection:
8 of 22 (36.36%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=73ljja6gkeskvijrup5u5gkqr3qes63wokargsn34va7kqo7knra._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/231023-hjl97sef3v/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks computer location settings
Modifies file permissions
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments