Loading malware…
STRRAT, also known as Strigoi Master, is a Java-based remote access trojan observed since at least mid-2020. It is Windows-focused despite its Java implementation, and some distribution packages bundle or install a Java Runtime Environment to execute on systems without Java preinstalled. It has been used by cybercriminal actors including TA2541 and Bloody Wolf, also tracked as Stan Ghouls. TA2541 has deployed it in campaigns targeting aviation, aerospace, transportation, manufacturing, and defense organizations.
STRRAT executes commands received from command-and-control servers and supports command-shell and PowerShell execution, payload downloading and execution, file management and exfiltration, process enumeration and termination, remote screen control, and reverse proxying. It steals credentials from browsers and email clients, including Chrome, Firefox, Internet Explorer, Edge, Outlook, Thunderbird, and Foxmail. Its keylogger captures keystrokes and active window titles, with offline logging and immediate transmission modes. It collects host and security-software information, supports privilege-escalation attempts, and can install RDPWrap or Hidden RDP components to enable remote desktop access. Persistence mechanisms include scheduled tasks, Startup-folder copies, and registry autorun entries.
Distribution commonly uses phishing and malicious spam with business-themed lures, including shipping documents, orders, and payment verification. Infection chains have delivered JAR payloads directly in archives, through macro-enabled Office documents, or through intermediate downloaders such as RATDispenser and Vjw0rm. Campaigns have also concealed STRRAT Java archives by appending them to signed Windows installer packages. Java obfuscation and encrypted configuration data hinder analysis and detection. Early variants included pseudo-ransomware functionality that renamed files without encryption; later analyzed variants implemented AES-128 file encryption and attacker-controlled ransom-note display.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In recent campaigns, vjw0rm and STRRAT also leveraged task creation and adding entries to the registry.
Historically, the group’s weapon of choice was the remote access Trojan (RAT) STRRAT, also known as Strigoi Master.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware establishes persistence by creating a scheduled task called “Skype”.
STRRAT is a multi-capability Remote Access Trojan... Unusually, it is Java-based
Run method: CMD.EXE /C C:\User\bin\java.exe -jar C:\User\x.jar
The malware establishes persistence by creating a scheduled task called “Skype”.
creates a new entry under the “Software\Microsoft\Windows\CurrentVersion\Run” registry key ... prevents the display of the last username by modifying a Registry value.
The malware establishes persistence by creating a scheduled task called “Skype”.
In addition, despite other classes being obfuscated, there are deobfuscated classes referring to Windows USER32, WinGDI, Kernel32, and HBrowserNativeApis keywords.
As Figure 1 shows, this sample is clearly not from Maersk Shipping. The threat actors are hoping that recipients do not look too closely.
perform keylogger activities ... implements the addKeyListener function, which listens to keyPressed and keyReleased events ... The window name on which the keys were pressed is also recorded.
It retrieves the content of the “COMPUTERNAME” (or “HOSTNAME”) and “USERNAME” environment variables that will be exfiltrated.
processes command — The RAT retrieves a list of running processes via a WMI query, which will be exfiltrated to the C2 server.
perform keylogger activities ... implements the addKeyListener function, which listens to keyPressed and keyReleased events ... The window name on which the keys were pressed is also recorded.
During this infection, STRRAT was installed... The following traffic occured on an infected Windows host: 54.202.26[.]55 port 80 ... port 443 ... 105.109.211[.]84 port 1990 ... TCP traffic generated by STRRAT
rev-proxy command — This command implements a reverse proxy on the host. It receives a “CONNECT IP:Port” request and sends back a “200 Connection Established” message.
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Trojan distributed using an MSI/JAR polyglot that combined a signed Windows installer with appended malicious Java code. The content does not describe its post-infection capabilities.
A trojan distributed using a polyglot combining a signed Windows MSI installer with malicious Java JAR code appended to its end. The content does not describe its post-infection capabilities.
Remote access trojan previously used by the Stan Ghouls/Bloody Wolf group in targeted campaigns.
Remote access trojan previously used by the actor prior to shifting to NetSupport RAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.