STRRAT

threat actors often use shipping as a lure for phishing emails—such as false invoices, changes in shipping delivery, or notices related to a fictitious purchase—to entice recipients into opening malicious attachments and inadvertently downloading malware.

This sample dispenses with that tactic and instead attaches the final payload directly to the phishing email.

The phishing email shown in Figure 2 is part of this attack campaign. It targets staff members, implying that a payment is underway and encourages them to click a button to verify payment information. Upon clicking the button, a harmful JAR file hosted on AWS is downloaded to the victim's computer.

The malware establishes persistence by creating a scheduled task called “Skype”.

STRRAT is a multi-capability Remote Access Trojan... Unusually, it is Java-based

Run method: CMD.EXE /C C:\User\bin\java.exe -jar C:\User\x.jar

Including JRE allows this Java-based RAT to run on vulnerable Windows hosts whether or not they have Java installed... CMD.EXE /C C:\User\bin\java.exe -jar C:\User\x.jar

If a victim opens the spreadsheet and enables macros on a vulnerable Windows host, the macro code generates unencrypted HTTP traffic to 54.202.26[.]55.

The malware establishes persistence by creating a scheduled task called “Skype”.

creates a new entry under the “Software\Microsoft\Windows\CurrentVersion\Run” registry key ... prevents the display of the last username by modifying a Registry value.

The process runs RDPWrap, creates a new user consisting of five letters, and prevents the display of the last username ... The new username is sent to the C2 server.

STRRAT accomplishes this by copying itself into a new directory and then adding entries to the Windows registry to run at system startup.

The malware establishes persistence by creating a scheduled task called “Skype”.

STRRAT accomplishes this by copying itself into a new directory and then adding entries to the Windows registry to run at system startup.

req-priv command — The process tries to launch itself with admin privileges by sending a UAC prompt to the user using the “-verb runAs” Powershell parameters.

In addition, despite other classes being obfuscated, there are deobfuscated classes referring to Windows USER32, WinGDI, Kernel32, and HBrowserNativeApis keywords.

As Figure 1 shows, this sample is clearly not from Maersk Shipping. The threat actors are hoping that recipients do not look too closely.

The configuration file called “config.txt” is decrypted using the AES algorithm, with the key derived from the “strigoi” string.

creates a new entry under the “Software\Microsoft\Windows\CurrentVersion\Run” registry key ... prevents the display of the last username by modifying a Registry value.

perform keylogger activities ... implements the addKeyListener function, which listens to keyPressed and keyReleased events ... The window name on which the keys were pressed is also recorded.

steal passwords from multiple browsers and email clients ... chrome-pass ... foxmail-pass ... outlook-pass ... fox-pass ... tb-pass ... ie-pass ... save-all-pass command

foxmail-pass command ... outlook-pass command ... tb-pass command

The “Login Data” database is copied ... the malware extracts the following fields: “action_url”, “username_value”, and “password_value”.

It retrieves the content of the “COMPUTERNAME” (or “HOSTNAME”) and “USERNAME” environment variables that will be exfiltrated.

processes command — The RAT retrieves a list of running processes via a WMI query, which will be exfiltrated to the C2 server.

STRRAT queries the host to determine its architecture and anti-virus capability on startup.

It also queries running processes, local storage, and network capability.

perform keylogger activities ... implements the addKeyListener function, which listens to keyPressed and keyReleased events ... The window name on which the keys were pressed is also recorded.

remote-screen command ... The RAT creates two threads that implement the remote screen function.

Long story short, you can append Java Archive (JAR) files to MSI files without hindering the operation of either file type. Java reads the JAR from end to front and msiexec reads from front to end.

During this infection, STRRAT was installed... The following traffic occured on an infected Windows host: 54.202.26[.]55 port 80 ... port 443 ... 105.109.211[.]84 port 1990 ... TCP traffic generated by STRRAT

rev-proxy command — This command implements a reverse proxy on the host. It receives a “CONNECT IP:Port” request and sends back a “200 Connection Established” message.

On the network side of things, we see STRRAT looking to reach out and pull down several Java dependencies upon startup.

It downloads RDPWrap from http[:]//wshsoft[.]company/multrdp.jpg, which enables Remote Desktop Host support on Windows.

A new socket that transmits the information to the C2 server is created ... Finally, the last subcommand is used to exfiltrate a regular file to the remote server.

rw-encrypt command — This command implements the ransomware module of the malware. It encrypts the files found in the Downloads, Documents, and Desktop folders ... Finally, the extension of the encrypted files is changed to “.crimson”.

show-msg command — The malware creates the ransom note called “crimson_info.txt” and populates it with content received from the C2 server.