MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80309845ae5fd64631d90cdc27cb20b71dabc8d9ba995b6a9227db802ba364ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	80309845ae5fd64631d90cdc27cb20b71dabc8d9ba995b6a9227db802ba364ea
SHA3-384 hash:	ce8863c42c06eeb860d12e868e77c44828e9105027417b990f81fd75b7023e0249b4751d0386fbaa43443069b185d96d
SHA1 hash:	5a167a06ae4ca755678cc5ad3ccf157d1c83586e
MD5 hash:	966a8bce0e8334e7a11ce28108be7679
humanhash:	aspen-fifteen-quebec-uranus
File name:	1964927648555326306.js
Download:	download sample
Signature	StrelaStealer Alert Create hunting rule
File size:	253'630 bytes
First seen:	2024-12-02 10:52:34 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:2dGOQJ1DAeBCrjAqi4ri0hMsvbjQ6T/ioQ6nbyfqeya2bldeNc7syIoSFWa7/GME:s
TLSH	T1D844E1F08622B6BD7532D3381606080B9691FACF3DFC1E6CDC19649A25F637E0177A99
Magika	javascript
Reporter	cocaman
Tags:	js StrelaStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

449

Origin country :

CH

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674d929ee64d1c722d7b4cf7

Tags:

spawn sage hype

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin net regsvr32 timeout

Link:

https://www.filescan.io/uploads/674d9190b5c446ebe9aefe68/reports/794d55a0-39ae-4880-86d2-413fe6b92c8f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/80309845ae5fd64631d90cdc27cb20b71dabc8d9ba995b6a9227db802ba364ea

Joe Sandbox Strela Downloader

Result

Threat name:

Strela Downloader

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1566537

Signature

Gathers information about network shares

JScript performs obfuscated calls to suspicious functions

Sigma detected: WScript or CScript Dropper

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Strela Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/80309845ae5fd64631d90cdc27cb20b71dabc8d9ba995b6a9227db802ba364ea

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/80309845ae5fd64631d90cdc27cb20b71dabc8d9ba995b6a9227db802ba364ea/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qayjqrnol7lemmozbtocpszaw4o2xsgzxkmvw2use7nyak5dmtva._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution

Link:

https://tria.ge/reports/241202-myyzrs1mht/

Behaviour

Delays execution with timeout.exe

Runs net.exe

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI StrelaStealer

Threat name:

StrelaStealer

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/80309845ae5fd64631d90cdc27cb20b71dabc8d9ba995b6a9227db802ba364ea