MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ede84486455cb721d4da7513b2c050e67fe4473e84f2df1cffe3fcfca5c0e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	30ede84486455cb721d4da7513b2c050e67fe4473e84f2df1cffe3fcfca5c0e2
SHA3-384 hash:	9b14998224df27d01ebcb518c6a0b5036f075b02811ff7c8543ace669daa7c73657af6ab36080f16b773c54b418dcf6b
SHA1 hash:	77a34f3c8b79a670697ff041342843752cbd67b4
MD5 hash:	036ba29a0c5b36773ea1c6dfc55d2575
humanhash:	happy-johnny-pasta-may
File name:	Quotation_RFQX0465732_4.rar
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	7'435 bytes
First seen:	2026-06-06 18:44:23 UTC
Last seen:	2026-06-08 15:01:57 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	192:JDgVpJm6r/XXowl/Xq8pSUyui6TprZHJXPmpbAy/DkfMA:JDg1nr/XYePDQDRSrCmfMA
TLSH	T195E19E1D65B8F6267E4483CA6992E4FD72CC4DA120ED3C6A51E719E241002ECB3B1FDE
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	PhantomStealer rar

Intelligence

---

File Origin

# of uploads :

6

# of downloads :

56

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Quotation_RFQ 0465732_4.js
File size:	73'341 bytes
SHA256 hash:	2b65cc65e88bef859ffc216258c8afc3e08b80f3efc607fd5168902a4295c5ea
MD5 hash:	f045f6b367a478fa665cefe2f19a606a
MIME type:	text/plain
Signature	PhantomStealer

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/2da77240-45b8-4d18-93b3-f064e57ea970/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Other.Malware-gen.17814814.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2149e157b7bf261d60c9db

Tags:

obfuscate xtreme shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm fingerprint repaired

Link:

https://www.filescan.io/uploads/6a246aca77463968d61af765/reports/4682c72f-e6d5-4e87-a86a-9c91c674218c/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/30ede84486455cb721d4da7513b2c050e67fe4473e84f2df1cffe3fcfca5c0e2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-04T11:52:00Z UTC

Last seen:

2026-06-08T10:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/30ede84486455cb721d4da7513b2c050e67fe4473e84f2df1cffe3fcfca5c0e2/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/30ede84486455cb721d4da7513b2c050e67fe4473e84f2df1cffe3fcfca5c0e2/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-04 11:11:47 UTC

AV detection:

11 of 24 (45.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gdw6qregivoloiou3j2rhmwakdth7zchh2cpfxy477r7z7ffydra._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/30ede84486455cb721d4da7513b2c050e67fe4473e84f2df1cffe3fcfca5c0e2