ctrlINT What the industry said about every indicator, with the quote

STRRATMalware

STRRAT is a Java-based RAT, which makes extensive use of plugins to provide full remote access to an attacker, as well as credential stealing, key logging and additional plugins. The RAT has a focus on stealing credentials of browsers and email clients, and passwords via keylogging.From MISP Galaxy

Last reported 10 months ago, by Group-IB1 report

ATT&CK techniques

6 of 15 · each with the sentence it comes from
  1. T1053Scheduled Task/Job

    “Scheduled Task/Job (T1053)”

    Group-IBVendor
  2. T1053.005Scheduled Task

    “Their main difference is the use of different paths to download NetSupport components, registry keys, and scheduled tasks.”

    Group-IBVendor
  3. T1059Command and Scripting Interpreter

    “Command and Scripting Interpreter (T1059)”

    Group-IBVendor
  4. T1059.003Windows Command Shell

    “Windows Command Shell (T1059.003)”

    Group-IBVendor
  5. T1071Application Layer Protocol

    “Application Layer Protocol (T1071)”

    Group-IBVendor
  6. T1071.001Web Protocols

    “Web Protocols (T1071.001)”

    Group-IBVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “The group initially used commercial STRRAT malware.”

    Group-IBVendor
    Bloody Wolf: A Blunt Crowbar Threat To Justice

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with STRRAT here?
No account needed. We do not store your IP address.