{"id":1583,"date":"2024-09-24T10:43:48","date_gmt":"2024-09-24T10:43:48","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=1583"},"modified":"2025-07-29T07:17:49","modified_gmt":"2025-07-29T07:17:49","slug":"analysis-of-strrat-campaign","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/analysis-of-strrat-campaign\/","title":{"rendered":"Analysis of STRRAT Campaign"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

STRRAT is a multi-functional Java-based Remote Administration Trojan (RAT)<\/strong> which is capable of stealing login credentials saved on browsers, logging keystrokes, and remotely controlling infected systems running on Windows platform. Also, it has the capability of servicing ransomware attacks which render files stored on victims’ computers inaccessible. The sample we examined attempts to target German user base predominantly.<\/p>\n\n\n\n

Targeted OS \u2013 MS Windows Platform<\/p>\n\n\n\n

Target Geography: Austria, Canada, Germany, Spain, UK, USA<\/p>\n\n\n\n

Languages used by the authors \u2013 Java, VBS (Visual Basic) & Powershell<\/p>\n\n\n\n

Static Analysis of STRRAT (JAR) sample<\/strong><\/h2>\n\n\n\n

Java Version Details of sample examined
MD5 Hash – 5f4dcc3b5aa765d61d8327deb882cf99
SHA256 \u2013 c7ed1cec47b5f8d575e739d4c77d86a6222a64539e5870229fc4488bb0b50b05<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Here are additional insights about this campaign after examining the source code:<\/strong><\/p>\n\n\n\n

    \n
  • The attackers behind this campaign used compromised email accounts to send out spam messages, including an image that was portrayed as a PDF attachment or any blurred images.<\/li>\n<\/ul>\n\n\n\n
      \n
    • When an unsuspecting recipient opens the image, the malicious code makes a connection to a domain for downloading STRRAT payload on the victim’s machine.<\/li>\n<\/ul>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
        \n
      • From the image below, it can be inferred that a ‘remote’ command is used to initiate a ‘RDP’ connection to the system and enable remote control of the mouse and keyboard input.<\/li>\n<\/ul>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
          \n
        •  The latest version of STRRAT (v1.5) is more obfuscated and modular than the previous one. It supports various features such as logging keystrokes, collecting browser passwords, and running remote commands and PowerShell.<\/li>\n<\/ul>\n\n\n\n
          \"\"<\/figure>\n\n\n\n
            \n
          • The RAT focuses on stealing credentials of browsers (IE, Chrome, Firefox) and email clients (Outlook, Thunderbird, Foxmail).<\/li>\n<\/ul>\n\n\n\n
            \"\"<\/figure>\n\n\n\n

            Dynamic Analysis of STRRAT (JAR) sample<\/strong><\/h2>\n\n\n\n

            Infection Chain<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            Sample Information<\/strong><\/p>\n\n\n\n

            Threat Name: STRRAT | Classification: Dropper| Category: Dropper \/ Remote Administration Tool<\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            Technical Analysis of JAR file<\/strong>;<\/h3>\n\n\n\n

            JAR (aka Java Archive) is a file format that aggregates several files into one file. Let\u2019s begin with our sample.<\/p>\n\n\n\n

            \"\"
            JAR – Main Content<\/figcaption><\/figure>\n\n\n\n

            <\/p>\n\n\n\n

            This Java environment differs from other programming environments in that the Java compiler does not generate machine code for a hardware-specific instruction set. Instead, the Java compiler converts Java source code into Java virtual machine instructions, which Java class files store. Basically, we can use JAR files to store class files. The class file does not target a specific hardware platform, but instead targets the Java virtual machine architecture.<\/p>\n\n\n\n

            \"\"
            Structure of JAR<\/figcaption><\/figure>\n\n\n\n

            Java Class files<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            Importance of Class files<\/strong><\/p>\n\n\n\n

            Java class files are stream files that are produced when a source file is compiled by the Java compiler. The class file contains tables that describe each field and method of the class. The file also contains the byte-codes for each method, static data, and descriptions that are used to represent Java objects.<\/p>\n\n\n\n

            Manifest – JAR File info<\/strong><\/p>\n\n\n\n

            Manifest is an important one where any executable JAR file that contains a stand-alone application, a Main-Class attribute should exist that provides the name of the first piece of code for the Java Runtime Environment (JRE) to invoke when the application is run.<\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            Suspicious Strings<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            Process Tree for STRRAT<\/strong><\/p>\n\n\n

            \n
            \"\"<\/figure>\n<\/div>\n\n\n

            Once the system is infected, here are few activities carried out by STRRAT<\/strong>,<\/p>\n\n\n\n

            STRRAT gathers the following information, upon execution,<\/p>\n\n\n\n

              \n
            • Username<\/li>\n\n\n\n
            • System OS Version<\/li>\n\n\n\n
            • System Architecture<\/li>\n\n\n\n
            • Presence of antivirus software<\/li>\n\n\n\n
            • Version of STRRAT installed\/used<\/li>\n\n\n\n
            • Geolocation of the victim (i.e.; Country)<\/li>\n\n\n\n
            • Whether STRRAT is already installed or not? <\/li>\n\n\n\n
            • Check the Browsing History & System idle time<\/li>\n<\/ul>\n\n\n\n

              Appendix A \u2013 Commands gleaned from deobfuscated java source code of STRRAT<\/strong><\/h3>\n\n\n\n
              \n
              \n
              \n
              Remote Commands – STRRAT<\/strong><\/td>Description of Command<\/strong><\/td><\/tr>
              reboot<\/td>Reboot the device<\/td><\/tr>
              shutdown<\/td>Shutdown the device<\/td><\/tr>
              uninstall<\/td>Remove the malware from the device<\/td><\/tr>
              disconnect<\/td>Disconnect the device from the C2 server<\/td><\/tr>
              down-n-exec<\/td>Download a file from a URL and execute it<\/td><\/tr>
              update<\/td>Update the malware<\/td><\/tr>
              up-n-exec<\/td>Upload a file directly to the device from the C2 server and then execute it<\/td><\/tr>
              remote-cmd<\/td>Remote command prompt<\/td><\/tr>
              power-shell<\/td>Remote PowerShell prompt<\/td><\/tr>
              file-manager<\/td>View files on the device<\/td><\/tr>
              processes<\/td>Lists running processes on the device<\/td><\/tr>
              startup-list<\/td>Lists startup items enabled on the device<\/td><\/tr>
              remote-screen<\/td>Remotely view the device screen<\/td><\/tr>
              rev-proxy<\/td>Use the device as a reverse proxy server<\/td><\/tr>
              hrdp-new<\/td>Utilize a Hidden RDP, enable a Remote Desktop client<\/td><\/tr>
              hrdp-res<\/td>Utilize a Hidden RDP while taking argument<\/td><\/tr>
              <\/td><\/td><\/tr>
              Keylogging<\/strong><\/td>Description of Command<\/strong><\/td><\/tr>
              keylogger<\/td>Start keylogging on the device, send logs to the C2 server<\/td><\/tr>
              o-keylogger<\/td>Start offline keylogging on the device, save the logs to the disk<\/td><\/tr>
              <\/td><\/td><\/tr>
              Credential Stealer<\/strong><\/td>Description of Command<\/strong><\/td><\/tr>
              chrome-pass<\/td>Extract Chrome passwords from device and send to C2<\/td><\/tr>
              foxmail-pass<\/td>Extract Fox mail passwords from device and send to C2<\/td><\/tr>
              outlook-pass<\/td>Extract Outlook passwords from device and send to C2<\/td><\/tr>
              fox-pass<\/td>Extract Firefox passwords from device and send to C2<\/td><\/tr>
              tb-pass<\/td>Extract Thunderbird passwords from device and send to C2<\/td><\/tr>
              ie-pass<\/td>Extract Internet Explorer passwords from device and send to C2<\/td><\/tr>
              all-pass<\/td>Extract all passwords from device and send to command and C2<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n

              Appendix B – Indicators of Compromise for STRRAT<\/strong><\/h3>\n\n\n\n

              Network Indicators<\/strong><\/p>\n\n\n\n

              hxxp[:\/\/]wshsoft[.]company\/jre7[.]zip<\/p>\n\n\n\n

              hxxps[:\/\/]pastebin[.]com\/raw\/Jdnx8jdg<\/p>\n\n\n\n

              hxxps[:\/\/]pastebin[.]com\/u\/wshsoft<\/p>\n\n\n\n

              pluginserver[.]duckdns[.]org<\/p>\n\n\n\n

              hxxp[:\/\/]str-master[.]pw\/strigoi\/server\/ping[.]php?lid=<\/p>\n\n\n\n

              moregrace[.]duckdns[.]org<\/p>\n\n\n\n

              hxxp[:\/\/]jbfrost[.]live\/strigoi\/server\/?hwid=1&lid=m&ht=5<\/p>\n\n\n\n

              palaintermine[.]duckdns[.]org<\/p>\n\n\n\n

              ip-api[.]com\/json\/<\/p>\n\n\n\n

              hxxp[:\/\/]wshsoft[.]company\/multrdp[.]jpg<\/p>\n\n\n\n

              <\/p>\n\n\n\n

              Host Indicators<\/strong><\/p>\n\n\n\n

              HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ntfsmgr<\/p>\n\n\n\n

              64578lock.file<\/p>\n\n\n\n

              3219lock.file<\/p>\n\n\n\n

              Scheduled Task – “Skype”<\/p>\n\n\n\n

              HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v dontdisplaylastusername = 1<\/p>\n\n\n\n

              <\/p>\n\n\n\n

              STRRAT JAR IOC<\/strong><\/p>\n\n\n\n

              hXXp:\/\/jbfrost[.]live\/strigoi\/server\/?hwid=1&lid=m&ht=5<\/p>\n\n\n\n

              carLambo<\/p>\n\n\n\n

              HBrowserNativeApis<\/p>\n\n\n\n

              config.txt<\/p>\n\n\n\n

              loorqhustq<\/p>\n\n\n\n

              <\/p>\n\n\n\n

              MITRE ATT&CK Tactics & Techniques for STRRAT<\/strong><\/h3>\n\n\n\n
              ID<\/td>Tactic<\/td>Technique<\/td><\/tr>
              TA0001<\/td>Initial Access<\/td>Spearphishing Attachment<\/td><\/tr>
              TA0002<\/td>Execution<\/td>Windows Scripting – JAR Exploitation for Client Execution<\/td><\/tr>
              TA0003<\/td>Persistence<\/td>Services File Permissions Weakness Registry Run Keys \/ Startup Folder<\/td><\/tr>
              TA0004<\/td>Privilege Escalation<\/td>Scheduled Task<\/td><\/tr>
              TA0005<\/td>Defense Evasion<\/td>Modify Registry Obfuscated Files or Information Virtualization Evasion Technique<\/td><\/tr>
              TA0006<\/td>Credential Access<\/td>Credentials in Registry Credentials in Files Credential Dumping<\/td><\/tr>
              TA0007<\/td>Discovery<\/td>System Network Configuration Discovery Process Discovery File and Directory Discovery Query Registry<\/td><\/tr>
              TA0008<\/td>Lateral Movement<\/td>Remote file copy<\/td><\/tr>
              TA0009<\/td>Collection<\/td>Archive Collected Data Data from Local System<\/td><\/tr>
              TA0011<\/td>C&C Server<\/td>Encrypted Channels Web Protocols Standard Application Layer Protocol Standard Cryptographic Protocol etc.,<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"

              STRRAT is a multi-functional Java-based Remote Administration Trojan (RAT) which is capable of stealing login credentials saved on browsers, logging keystrokes, and remotely controlling infected systems running on Windows platform. Also, it has the capability of servicing ransomware attacks which render files stored on victims’ computers inaccessible. The sample we examined attempts to target German […]<\/p>\n","protected":false},"author":1,"featured_media":1745,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=1583"}],"version-history":[{"count":3,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1583\/revisions"}],"predecessor-version":[{"id":4401,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1583\/revisions\/4401"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/1745"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=1583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=1583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=1583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}