Rewterz Threat Alert – STRRAT Malware – Active IOCs

Severity

High

Analysis Summary

Experts at the German cybersecurity firm identified the Java-based StrRAT malware in June 2020. This malware uses plugins to grant the attacker remote access. This malware steals login credentials from browsers and email clients, logs keystrokes, and exploits vulnerable Windows operating systems remotely. The malware adds the file extension (.crimson) to Notepad to show a bogus ransom message. STRRAT malware supports the browsers Firefox, Chrome, Foxmail, Outlook, Internet Explorer, and Thunderbird.
STRRAT permits threat actors to remotely control compromised machines/computers. According to research, this RAT can be used to run commands that let users upload files, download files, delete files, open files, restart computers, and carry out a variety of other tasks.
Furthermore, users who have the STRRAT installed on their computers run the risk of experiencing issues with online privacy, surfing security, financial loss, identity theft, account lockout, system infection with further infections, etc.

Impact

• Unauthorized access
• Information theft
• Exposure of sensitive data

Indicators of Compromise

MD5

c2704bb9dbe7cae358cb8c21f932ee68
3fce9d0f8646eb457cada3e55b7371ab

SHA-256

d5b1bb1031b3d294c95a217ab8fdbdba9604e36a9cd636cfedaaa55d70c4a20a
b3f6c737e0fc54b19e45aac369db1bdfc697319a65329a8abfa4c28e80534213

SHA-1

11c5a4b586768bfc7ea22f732d5f7f8ee87c7a2a
336c62781422af93e81c4da77071f20afe4dcaa3

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.
• Passwords – Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
• Admin Access – limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets