Severity
High
Analysis Summary
Java has a new RAT titled STRRAT that is now shipping with the .crimson ransomware module. Typical infection begins with a spam email containing a malicious attachment with a .JAR extension. This JAR file drops a .VBS file which executes a script via PowerShell. This script drops a second. VBS file. This file downloads the Java Runtime Environment allowing the payload ntfsmgr.jar to download and install a hidden RDPWrap. Finally, there is a download of lib.zip containing jar dependencies. With a variety of commands at its disposal, this RAT is robust and persistent. Features contained in the RAT include rebooting the machine, downloading and executing files, enabling cmd.exe, keylogging, and a rudimentary ransomware module. This module appends .crimson to encrypted files. This RAT is limited in that it only works with Windows machines, needs a pre-installed JRE (presently), and Outlook blocks the attachment.
Impact
- File Encryption
Indicators of Compromise
MD5
- e7f80328486605168abe86df4432d804
- b275775a183f3bd10187e6c5fba56a93
SHA-256
- 6098a346268988630831b90d01b46d1d35ad9bb4127b1c912d013cf6aef8c049
- 0820662185b1032a0fec1f7ba2d446cb0d31d4e10803de5f6cd9d8853fbcbe41
SHA-1
- abbbf414ad1b1ea17fa861dccb9bdac91460c0c4
- 9b38f7158561671cc5796f35efdd976cf2e81460
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.