analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1.jar

Full analysis: https://app.any.run/tasks/7aef259a-5fda-42c9-aa89-c20fd741f00a
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 06:51:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
strrat
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B4F7583051E83996AD8D24F6FE6800DB

SHA1:

704CC679D91A5C1783A6C7911E2E09C70C825795

SHA256:

0BEC974068FD7804C1D4A9F08F35187655935DFAABFEB616F57CF3808A6018C6

SSDEEP:

1536:gJ/o1AzGP1M9Q+1+j/Zc82nGSNPsPjS05pLTuj6T+4mheT+RHGvtvxYpRHrj4:gJlzGP14QHjQGwPuj759TuWTtT+4v4L0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • StrRat is detected

      • javaw.exe (PID: 3224)

    • Loads dropped or rewritten executable

      • java.exe (PID: 1368)
      • java.exe (PID: 860)

    • Writes to the Start menu file

      • java.exe (PID: 1368)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2128)

    • Saves itself using an automatic execution at the hidden registry location

      • java.exe (PID: 1368)

    • Changes the autorun value in the registry

      • java.exe (PID: 1368)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3904)

    • STRRAT was detected

      • java.exe (PID: 860)

    • STRRAT detected by memory dumps

      • java.exe (PID: 860)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify the access control list

      • javaw.exe (PID: 3224)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 3224)
      • java.exe (PID: 1368)
      • java.exe (PID: 860)

    • Executes JAVA applets

      • javaw.exe (PID: 3224)
      • java.exe (PID: 1368)

    • Application launched itself

      • java.exe (PID: 1368)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 1368)

  • INFO

    • Creates files in the program directory

      • javaw.exe (PID: 3224)

    • Checks supported languages

      • javaw.exe (PID: 3224)
      • java.exe (PID: 1368)
      • java.exe (PID: 860)

    • Creates a file in a temporary directory

      • javaw.exe (PID: 3224)
      • java.exe (PID: 1368)
      • java.exe (PID: 860)

    • Reads the computer name

      • javaw.exe (PID: 3224)
      • java.exe (PID: 1368)
      • java.exe (PID: 860)

    • Process checks LSA protection

      • javaw.exe (PID: 3224)
      • java.exe (PID: 1368)
      • java.exe (PID: 860)

    • Creates files in the user directory

      • java.exe (PID: 1368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

STRRAT

(PID) Process(860) java.exe
Options
LIDkhonsa
Proxy208.67.105.233
Skype Scheduled Task Persistencetrue
Secondary Startup Folder Persistencetrue
Startup Folder Persistencetrue
URLhttp://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Port1987
C2teewirman.ddns.net
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe icacls.exe no specs java.exe cmd.exe no specs #STRRAT java.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3224"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\1.jar"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
Explorer.EXE
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
1464C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\system32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1368"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\1.jar"C:\Program Files\Java\jre1.8.0_271\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
3904cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\1.jar"C:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
860"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\AppData\Roaming\1.jar"C:\Program Files\Java\jre1.8.0_271\bin\java.exe
java.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
STRRAT
(PID) Process(860) java.exe
Options
LIDkhonsa
Proxy208.67.105.233
Skype Scheduled Task Persistencetrue
Secondary Startup Folder Persistencetrue
Startup Folder Persistencetrue
URLhttp://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Port1987
C2teewirman.ddns.net
2128schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\1.jar"C:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 070
Read events
2 069
Write events
1
Delete events
0

Modification events

(PID) Process:(1368) java.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:1
Value:
"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\1.jar"
Executable files
8
Suspicious files
9
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3224javaw.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:978CA04DE628C0BD1D38B50EFEE165B7
SHA256:24038EEFF60F8BBA06857C396325C7788843DB05A822CB7A43A8FA0A6722D084
1368java.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.jarcompressed
MD5:B4F7583051E83996AD8D24F6FE6800DB
SHA256:0BEC974068FD7804C1D4A9F08F35187655935DFAABFEB616F57CF3808A6018C6
1368java.exeC:\Users\admin\AppData\Roaming\1.jarcompressed
MD5:B4F7583051E83996AD8D24F6FE6800DB
SHA256:0BEC974068FD7804C1D4A9F08F35187655935DFAABFEB616F57CF3808A6018C6
3224javaw.exeC:\Users\admin\1.jarcompressed
MD5:B4F7583051E83996AD8D24F6FE6800DB
SHA256:0BEC974068FD7804C1D4A9F08F35187655935DFAABFEB616F57CF3808A6018C6
3224javaw.exeC:\Users\admin\lib\system-hook-3.5.jarcompressed
MD5:E1AA38A1E78A76A6DE73EFAE136CDB3A
SHA256:2DDDA8AF6FAEF8BDE46ACF43EC546603180BCF8DCB2E5591FFF8AC9CD30B5609
3224javaw.exeC:\Users\admin\lib\jna-platform-5.5.0.jarjava
MD5:2F4A99C2758E72EE2B59A73586A2322F
SHA256:24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5
1368java.exeC:\Users\admin\AppData\Roaming\lib\system-hook-3.5.jarcompressed
MD5:E1AA38A1E78A76A6DE73EFAE136CDB3A
SHA256:2DDDA8AF6FAEF8BDE46ACF43EC546603180BCF8DCB2E5591FFF8AC9CD30B5609
1368java.exeC:\Users\admin\AppData\Roaming\lib\jna-5.5.0.jarjava
MD5:ACFB5B5FD9EE10BF69497792FD469F85
SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
3224javaw.exeC:\Users\admin\lib\sqlite-jdbc-3.14.2.1.jardcompressed
MD5:B33387E15AB150A7BF560ABDC73C3BEC
SHA256:2EAE3DEA1C3DDE6104C49F9601074B6038FF6ABCF3BE23F4B56F6720A4F6A491
3224javaw.exeC:\Users\admin\lib\jna-5.5.0.jardjava
MD5:ACFB5B5FD9EE10BF69497792FD469F85
SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
12
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
860
java.exe
GET
404
142.93.110.250:80
http://str-master.pw/strigoi/server/ping.php?lid=khonsari
CA
html
178 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
140.82.121.4:443
github.com
GITHUB
US
malicious
3224
javaw.exe
140.82.121.4:443
github.com
GITHUB
US
malicious
—
—
151.101.112.209:443
repo1.maven.org
FASTLY
DE
suspicious
3224
javaw.exe
185.199.110.133:443
objects.githubusercontent.com
FASTLY
US
malicious
3224
javaw.exe
151.101.112.209:443
repo1.maven.org
FASTLY
DE
suspicious
860
java.exe
208.67.105.233:1981
—
Delis LLC
US
unknown
860
java.exe
142.93.110.250:80
str-master.pw
DIGITALOCEAN-ASN
DE
malicious
3224
javaw.exe
199.232.192.209:443
repo1.maven.org
FASTLY
US
suspicious

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.4
shared
repo1.maven.org
  • 151.101.112.209
  • 199.232.192.209
  • 199.232.196.209
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
objects.githubusercontent.com
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
shared
str-master.pw
  • 142.93.110.250
malicious
teewirman.ddns.net
  • —
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
860
java.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
860
java.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.pw domain
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1.jar