How to Analyze Java Malware – A Case Study of STRRAT

Prepared by: Vlad Pasca, Senior Malware &

Threat Analyst

SecurityScorecard.com

info@securityscorecard.com

Tower 49

12 E 49th Street

Suite 15-001

New York, NY 10017

1.800.682.1707

Table of contents

Table of contents 1

Executive summary 2

Analysis and findings 2

STRRAT commands 8

Indicators of Compromise 42

securityscorecard.com | 1

Executive summary

STRRAT is a Java-based malware that executes multiple commands transmitted by the C2 server. The JAR file was obfuscated using the Allatori obfuscator. It establishes persistence on the host by copying to the Startup folder and creating a scheduled task and a Run registry entry. The functionalities of the implemented commands in…