Focus Mode
Threat Research

New Italian StrRat campaign: a CyberChef recipe available to decode the malware

Italy-Cert-agid

Short Summary

This week, the StrRat malware has once again affected Italy. CERT-AGID has studied the new sample to provide a quick decoding tool for analysts. StrRat is a Remote Access Trojan (RAT) written in Java, primarily designed for information theft, featuring backdoor capabilities and a plugin architecture for complete remote access.

Keypoints

  • StrRat is a Remote Access Trojan (RAT) targeting information theft.
  • It uses a plugin architecture for enhanced remote access capabilities.
  • Keylogging and credential theft functionalities are included.
  • A decoding recipe using CyberChef has been created to facilitate the analysis of StrRat samples.
  • The recipe is effective for all StrRat samples detected in the last three years.

MITRE ATT&CK TTPs – created by AI

  • Credential Dumping (T1003)
    • Procedure: StrRat includes functionalities aimed at credential theft.
  • Remote Access Tools (T1219)
    • Procedure: StrRat provides complete remote access to attackers.
  • Data Encrypted (T1022)
    • Procedure: StrRat encrypts sensitive information within the config.txt file.

Full Article Translation

08/08/2024

This week, the malware StrRat has once again affected the Italian territory. CERT-AGID has therefore returned to study the new sample in order to provide a quick decoding tool for analysts.

It is worth noting that StrRat is a Remote Access Trojan (RAT) written in Java and primarily designed for information theft, also equipped with backdoor functionalities. It uses a plugin architecture to offer complete remote access to attackers and includes features aimed at credential theft, keylogging, and integration of additional plugins.

Position and content of the file “config.txt”

Since all useful information related to C2, the port, and the URL for downloading plugins is encrypted within the accompanying config.txt file, and the decoding has already been documented, we have created a CyberChef recipe that leverages advanced functions to facilitate and speed up the decoding process.

CyberChef Recipe

The concept is simple: the recipe takes a Base64 encoded input, decodes it to hexadecimal, cleans the text by removing whitespace, extracts the key and IV, derives a key using PBKDF2, and finally uses AES to decrypt the remaining data. The entire process is based on a secret key generated from the known password “strigoi”.

Link: CyberChef Recipe

Note: The recipe is effective for all StrRat samples detected in the last 3 years, as they are based on the known password ‘strigoi’. However, if the password were to change, it may be necessary to update the recipe to continue ensuring correct decoding.

Indicators of Compromise

In order to make the details of the analyzed sample public, the following IoCs derived are reported:

Link: Download IoC

Source: Original Post

Tags: BACKDOOR, PASSWORD, CREDENTIAL, TOOL, TROJAN