<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello, </div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>01/21/2022 - Diary entry #436:</div>
<div><br>
</div>
<blockquote style="margin-top:0; margin-bottom:0">
<div>A new phishing campaign was observed this week impersonating Maersk, a worldwide conglomerate in the shipping industry, delivering a Java-based RAT (Remote Access Trojan) known as STRRAT, targeting Windows users.
<div><br>
</div>
<div>STRRAT is a multi-capability Remote Access Trojan, that first appeared in 2020, and has the ability to steal browser credentials, log keystrokes, take remote control of infected systems, and deploy additional payloads onto the compromised machine. It also
has a module that executes a fake ransomware behavior, appending the file name extension ".crimson" to files without actually encrypting them. The remote control module works by dropping a remote access tool named HRDP.</div>
<div><br>
</div>
<div>Older STRRAT campaigns delivered the final payload using malicious Office documents containing macro codes. In this new campaign, STRRAT's final payload is directly attached to the emails. Its final payload code is obfuscated by a Java obfuscator tool
named Allatori which can be easily deobfuscated using open-source Java deobfuscators.</div>
<div><br>
</div>
STRRAT has its configurations encrypted using AES. Curiously, among its strings, we can find "khonsari", which is a ransomware variant that emerged after Log4J vulnerabilities had been disclosed. However, there is no evidence that they are related.<br>
</div>
</blockquote>
<div><br>
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="width:26px; height:18px; max-width:initial" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px">
</p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="margin-top: 0px; margin-bottom: 0px;color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="margin-top: 0px; margin-bottom: 0px;color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
C:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>