MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8
SHA3-384 hash:	2cf14fe1c219feae5bcce3de0da6ab582e4495a18aaf5645699f3227840d9f41b18af27be82eea082a16294b2eae89c9
SHA1 hash:	42a03f5d9a7c7cf5d44f668a875c610687fc770f
MD5 hash:	cd1fae91ad937447ef8a2f887b033e74
humanhash:	purple-island-stream-fix
File name:	Request For Quotation.js
Download:	download sample
Signature	STRRAT Alert Create hunting rule
File size:	849'452 bytes
First seen:	2026-06-05 08:34:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:OJEYDy29SnR6GXF0nUQLRbBDOEgE3tIEMFGBM4aem/cOxTN2nscgk294a5F7YVzx:q
TLSH	T1B4051F55B36A098B1B0BAF34341A1D6377B80B60EFDC49C49257EE998C5EFC70259E0B
Magika	javascript
Reporter	abuse_ch
Tags:	js RAT STRRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

114

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan-Downloader.JS.Agent.2200.92.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a228a1a57b7bf261d61239e

Tags:

shellcode emotet

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a228a0c77463968d61aa4e1/reports/05257f1c-d9f8-45e9-99b8-d448a28895e4/overview

Hybrid Analysis TrojanDropper/JS.Agent.c

Verdict:

Malicious

Labled as:

TrojanDropper/JS.Agent.c

Link:

https://www.hybrid-analysis.com/sample/6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-06-05T04:57:00Z UTC

Last seen:

2026-06-06T07:07:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic Backdoor.Agent.TCP.C&C HEUR:Trojan-Dropper.Script.SDrop.gen Backdoor.Java.Agent.dn Trojan.Java.Agent.sb BSS:Trojan.Win32.Generic Backdoor.Java.StrRat.sb Trojan-Dropper.JS.SDrop.sb HEUR:Trojan.Java.Agent.gen

Link:

https://opentip.kaspersky.com/6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8/results?tab=lookup

Joe Sandbox STRRAT

Result

Threat name:

STRRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1923508

Signature

Antivirus detection for URL or domain

Creates autostart registry keys to launch java

Exploit detected, runtime environment dropped PE file

Exploit detected, runtime environment starts unknown processes

Found malware configuration

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Uses schtasks.exe or at.exe to add and modify task schedules

Uses WMIC command to query system information (often done to detect virtual machines)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected AllatoriJARObfuscator

Yara detected STRRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8/

Neiki Family.STRRAT

Verdict:

Malicious

Threat:

Family.STRRAT

Link:

https://tip.neiki.dev/file/6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=n4ma27rkcgusffsqa2rz7z2sf2hj3c5ubkseshsvjavfwbc6w3ea._file

Hatching Triage strrat

Result

Malware family:

strrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:strrat execution persistence ransomware stealer trojan

Link:

https://tria.ge/reports/260605-kgk1gady5m/

Behaviour

Opens file in notepad (likely ransom note)

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Drops startup file

Loads dropped DLL

Family: STRRAT

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8