MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6547ae56e683d062433e3083d802a4504fb9e592894a6e2d75e4e4947a4efdd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6547ae56e683d062433e3083d802a4504fb9e592894a6e2d75e4e4947a4efdd8
SHA3-384 hash:	0db51e10cefa010340d83f85a88dff9f5946d9020ede8c98730dd721fd8b64c83bab89a3fbf2a4ca4efe1c51b9dedded
SHA1 hash:	0934c767e1907110c81aa0fac8d809a967d4f4e7
MD5 hash:	f95dec38745edcbb9c3d22555d77c94a
humanhash:	august-timing-alabama-virginia
File name:	2727240823238218669.js
Download:	download sample
Signature	StrelaStealer Alert Create hunting rule
File size:	5'910 bytes
First seen:	2024-07-09 06:05:37 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	96:xb/BBwzXIxcccQgZXIxcccRl9OYlvN7SKWN1Ft2B3+us2Eeep2B1ikV:pjwZP9vWl8B33xEPAB1ikV
TLSH	T1EFC154DBEEB6BFE8ED3111EBAB8F26748243D8D21F11C278755E142DDB2857090A10B0
Reporter	cocaman
Tags:	js StrelaStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

307

Origin country :

CH

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfuscated-ND.14367.252.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.VBS.Obfuscated-ND.3276.28169.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=668cd352d6caced36c82db31win10vpnfull_triage

Tags:

Execution Infostealer Network Stealth

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin net regsvr32

Link:

https://www.filescan.io/uploads/668cd34fb922f6f3343bcb2a/reports/b2a5987b-ac75-4594-ba86-555da4edb401/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/6547ae56e683d062433e3083d802a4504fb9e592894a6e2d75e4e4947a4efdd8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad.troj.spyw

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1469779

Signature

Gathers information about network shares

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6547ae56e683d062433e3083d802a4504fb9e592894a6e2d75e4e4947a4efdd8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6547ae56e683d062433e3083d802a4504fb9e592894a6e2d75e4e4947a4efdd8/

ReversingLabs TitaniumCloud Script-BAT.Trojan.AgentSetter

Threat name:

Script-BAT.Trojan.AgentSetter

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-07-09 06:05:40 UTC

File Type:

Text (CMake)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mvd24vxgqpigeqz6gcb5qavekbh3tzmsrffg4llv4tsji6so7xma._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution

Link:

https://tria.ge/reports/240709-gtrf8s1hre/

Behaviour

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.57

Link:

https://yomi.yoroi.company/submissions/6547ae56e683d062433e3083d802a4504fb9e592894a6e2d75e4e4947a4efdd8