New STRRAT RAT Phishing Campaign

Fortinet FortiGuard Labs analyzes a phishing campaign that delivers a STRRAT variant as a direct attachment, bypassing the usual dropper stage. The campaign uses spoofed shipping-themed emails, obfuscated Java payloads, and a mix of C2 communications and credential theft techniques, highlighting the malware’s persistence and modular capabilities. #STRRAT #Allatori #jbfrost.live #acalpulps #ftqpl.in

Keypoints

Phishing emails lure recipients with shipping-themed content and attach the final STRRAT payload directly, skipping intermediate droppers.
The emails spoof legitimate shipping entities (Maersk) and route through suspicious domains (acalpulps[.]com, ftqplc[.]in) with newly registered look-alike addresses.
The STRRAT sample is Java-based, includes a jar with obfuscated code (Allatori), and a base64-encoded yet scrambled config.txt.
Deobfuscation reveals an AES-encrypted config with the passphrase “strigoi,” facilitating configuration for the malware.
STRRAT features keylogging, browser/password credential theft, and the ability to drop a remote access tool (HRDP) for control.
Persistence is achieved by registry modifications, and STRRAT performs device/architecture checks, process and storage discovery, and network capabilities queries.

MITRE Techniques

[T1566.001] Phishing – The campaign uses shipping-themed emails to entice recipients to open malicious attachments. “Shipping is an indispensable part of modern life… threat actors often use shipping as a lure for phishing emails…”
[T1204.002] User Execution – The final payload is attached directly to the phishing email, prompting user action to execute.
[T1027] Obfuscated/Compressed Files and Information – The STRRAT jar contains scrambled/encoded strings and Allatori obfuscation.
[T1105] Ingress Tool Transfer – STRRAT “pull down several Java dependencies upon startup.”
[T1082] System Information Discovery – STRRAT “queries the host to determine its architecture and anti-virus capability” and also discovers processes, storage, and network capability.
[T1056.001] Input Capture – STRRAT can log keystrokes and maintain an HTML-based log.
[T1112] Modify Registry – STRRAT persists by copying itself and adding Windows registry startup entries.
[T1219] Remote Access Software – STRRAT can drop HRDP to facilitate remote control of the infected system.
[T1555.003] Credentials from Web Browsers – STRRAT siphons passwords from Chrome, Firefox, and Edge, plus email clients.
[T1071.001] Web Protocols – C2 traffic uses a domain/IP (198.27.77.242) and associated URLs/ports for command and control.
[T1021.001] Remote Services – The use of HRDP indicates remote access software usage for control.
[T1552] Unsecured Credentials (credential dumping from browsers and clients) – implicit in browser/email credential theft
[T1486] Data Encrypted for Impact (Pseudo-ransomware) – A pseudo-ransomware module attempts to manipulate files with a “.crimson” extension as a scare tactic.
[T1071.001] Web Protocols – The C2 URL (jbfrost[.]live) is observed as part of the infrastructure, even if currently unresolved.

Indicators of Compromise

[Email] [email protected] – used in phishing emails
[Email] [email protected] – used in phishing emails
[SHA-256] 409ad1b62b478477ce945791e15e06b508e5bb156c4981263946cc232df89996 (SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF[.]zip), 3380d42b418582b6f23cfd749f3f0851d9bffc66b51b338885f8aa7559479054 (SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF[.]jar)
[URL] hXXp://jbfrost[.]live/strigoi/server/?hwid=1&lid=m&ht=5 – C2-related URL
[IP] 198[.]27.77.242 – C2 IP address
[Domain] jbfrost[.]live – C2 infrastructure domain
[Domain] acalpulps[.]com – phishing domain
[Domain] ftqplc[.]in – phishing domain
[File] SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF[.]zip – ZIP containing STRRAT
[File] SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF (2)[.]zip – ZIP containing STRRAT
[File] SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF[.]jar – JAR payload

New STRRAT RAT Phishing Campaign | FortiGuard Labs