flash

NRB-RTGS 28-Sept 2021.jar

Status: finished
Submission Time: 28.09.2021 09:05:03
Malicious
Evader
Trojan
STRRAT

Comments

Tags

  • jar
  • STRRAT

Details

  • Analysis ID:
    492006
  • API (Web) ID:
    859575
  • Analysis Started:
    28.09.2021 09:09:00
  • Analysis Finished:
    28.09.2021 09:30:16
  • MD5:
    ccfdd7c24c9029f301ee94dbc9441ace
  • SHA1:
    99dce2074fd2cca2ede69a3b08cf33a574a4a976
  • SHA256:
    3ecc6468de96ac9ae350154c117610dd3062f968be547d6b67b3f126fee512e9
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
52/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Without Tracing

malicious
60/100

malicious
10/45

URLs

Name Detection
http://crl.xrampsecurity.com/XGCA.crl
https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar
http://crl.chambersign.org/chambersroot.crl0
Click to see the 32 hidden entries
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
http://www.certplus.com/CRL/class2.crl
http://bugreport.sun.com/bugreport/
http://cps.chambersign.org/cps/chambersroot.html0
http://java.oracle.com/
http://null.oracle.com/
http://www.chambersign.org1
http://repository.swisssign.com/0
https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
http://policy.camerfirma.com
https://ocsp.quovadisoffshore.com
https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar
http://crl.securetrust.com/STCA.crl0
http://www.quovadisglobal.com/cps
http://cps.chambersign.org/cps/chambersroot.html
http://www.certplus.com/CRL/class3P.crl
http://www.certplus.com/CRL/class3P.crl0
http://crl.securetrust.com/STCA.crl
http://www.certplus.com/CRL/class2.crl0
http://www.quovadisglobal.com/cps0
http://crl.xrampsecurity.com/XGCA.crl0
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
http://www.quovadis.bm
http://www.quovadis.bm0
https://ocsp.quovadisoffshore.com0
http://www.allatori.com
http://crl.chambersign.org/chambersroot.crl
http://repository.swisssign.com/
http://www.chambersign.org
https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar
http://policy.camerfirma.com0

Dropped files

Name File Type Hashes Detection
C:\cmdlinestart.log
ASCII text, with CRLF, LF line terminators
#
C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp
ASCII text, with CRLF line terminators
#
C:\jar\META-INF\MANIFEST.MF
ASCII text, with CRLF line terminators
#
Click to see the 67 hidden entries
C:\jar\carLambo\FLUCgYjjYukBnLOPJmMXa.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\FNfNjvjZirJsYBDQvbyXp.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\FirstRun.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\GDI32.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\HBrowserNativeApis.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\HZFTeYcSoingkrwfACxsS.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\IWRkRwQylUNIljRjtAkaC.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\IkqnNUVNYHrOTFlrdiXDE.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\InQtwvxSwGlKCGaPBlkoE.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\JBOWUuMcvCkhdglJnhRMv.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\KUmqyODGGRUyuSPgAiEHR.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\Kernel32.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\LMjLyRQVjrbfIpBrwheBI.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\LPFdzbdgUbctDqujAWZYI.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\MwXUjyQKvUCIJaqfYeEXR.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\NRSgeibhpMRqnMXxHCtkH.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\OfHKSMXcxdCQqFxyzUhpZ.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\PRecjdEZwdifBquTYRlUl.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\QdhsHELHRynENxdBimgsC.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\RhcfPXNPybLnSaSYqyEXw.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\RyDWjwZKMcstuZbiMGYqA.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\SpPnnJyNVMiKWFUPPBgAJ.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\User32.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\VMnlAvsfupVDCaszPEPjX.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\VuLgyZptDPIAaqUhBdkQg.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\WAjaJbPBkhpSMiTfTlSfV.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\WFnpewDUZzidjcKbMnKqG.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\WKTBLojTnJupFuAfwhtUj.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\WLVpZVKPTwBamUZoZCNyH.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\WinGDI.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\WppqWwSRlQJiTLfjgsmCj.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\YGZckHbbfSSCkmxMSahob.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\YYCouWIWxqsvPFMgyBqwW.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\ZeiFKvzcxODidyLNIuqkn.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\ZkwKzBMaxNbOlYdeHUyJr.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\aNhPdlHWbWcyZlRBjRTvT.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\amywDpahHAvKsbAjnpCoO.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\anzYKctnLiQPVOOntxFFV.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\chMqAfpdZnrPTUanWELCv.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\dAXHhOjprIGmjWiJRHaiQ.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\dpKhbKrSnHDyRqwJknedZ.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\eSHYGKVncDIRweeZuClPC.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\eWXALjSUSDRBlUrdVjYaX.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\eXJaDawGGAXnThaaGUiMt.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\gMLqgzFILKCRhknogvWcQ.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\gPLIBbXIRgEqoywxWrJpW.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\gnZAbPgVxflhpdLkKRSEC.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\hBSMFRWfUehfEMRTcdxur.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\hcHXKAfoYuEiOypNbthOq.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\ifmTFpwQLwUvcmBtqiUxG.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\jNOmAVANbBsSwqYRQpxgY.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\jadywgihJVmemkhExuzpm.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\jxScqCFTjrLlWNGYXdNEZ.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\koPaEdvZZnsDCtKcfImQC.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\lIljmvPgJhDKnHUcdUMQJ.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\nTSsWfapOWJzCPxPKlsSa.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\oKVVeurDdXccUodgtAiki.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\ppqPYkdOMPGLhnnFjoRgt.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\prIukYBclICdhLpsxJGHU.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\qaFhxuVWqPsAXIszXSnWD.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\resources\config.txt
ASCII text, with no line terminators
#
C:\jar\carLambo\trsUGiegHrIdIKYyegTti.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\vADhEfSlROOWFitmByjkH.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\vAJiRrxrPqrmdaYHqifDe.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\vmvXFcYvTedJqkhtugLYR.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\xdIozHlUXHmwNaqNNEWok.class
compiled Java class data, version 49.0 (Java 1.5)
#
C:\jar\carLambo\yphecTSiezxVkeTiKHCVh.class
compiled Java class data, version 49.0 (Java 1.5)
#