MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8080709035421e6a3c1e11909e8d86bbda4e043df3ee6a5d5f6c5d72bb37cbe7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

StrelaStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	8080709035421e6a3c1e11909e8d86bbda4e043df3ee6a5d5f6c5d72bb37cbe7
SHA3-384 hash:	29806c1a8e242ef6b88f2ec0c08c3e59b2350a02cda320ff7de24be2762348c5c05aa76e31c33dfeaadfdf42d9598680
SHA1 hash:	7991f36120f52eae4957fe2d12cba391bc32152e
MD5 hash:	501112da10b2a1dcc613dfcfde18b86e
humanhash:	twenty-mississippi-may-romeo
File name:	Rg 241111 Engin Psychiater Speyer b.pdf
Download:	download sample
Signature	StrelaStealer Create hunting rule
File size:	2'276 bytes
First seen:	2025-01-14 07:45:28 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	48:9oMsNmiq6Ku28YyV4TU5EQC6CeTHpeylyTY+bgCb74:aeRZaYyV2U5ZDCeTJefTZcCb74
TLSH	T188412B4011F5CF10CBC3507AADE159D9FB81411A37F9DA698456A0C00D263DC5BA66B7
Magika	zip
Reporter	cocaman
Tags:	pdf StrelaStealer zip

cocaman

Malicious email (T1566.001)
From: "Mohammad zaher Ghafar <no-reply@coopermail.net>" (likely spoofed)
Received: "from coopermail.net (unknown [39.34.97.169]) "
Date: "Tue, 14 Jan 2025 05:15:29 +0000"
Subject: "Rechnung"
Attachment: "Rg 241111 Engin Psychiater Speyer b.pdf"

Intelligence

File Origin

# of uploads :

# of downloads :

157

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	577119676170175151.js
File size:	10'681 bytes
SHA256 hash:	7ea19fe49bde243849c5ac053c923804eab7c115dc52c8ba08773a6e5e94323a
MD5 hash:	6a67fdc321979da402cdc6d7201aecdc
MIME type:	text/plain
Signature	StrelaStealer

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_jsnum225n.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6786163c4487910100dec3cb

Tags:

n/a

Result

Verdict:

Malicious

File Type:

JS File

Link:

https://app.docguard.net/8080709035421e6a3c1e11909e8d86bbda4e043df3ee6a5d5f6c5d72bb37cbe7/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated powershell webdav

Link:

https://www.filescan.io/uploads/6786164300fbe0ad29ea7ab1/reports/dd7a3fa7-75e2-47ce-ba11-a15921b80459/overview

Verdict:

Malicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/8080709035421e6a3c1e11909e8d86bbda4e043df3ee6a5d5f6c5d72bb37cbe7

Score:

99%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/250114-kh522avncp/

Behaviour

Command and Scripting Interpreter: JavaScript

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/8080709035421e6a3c1e11909e8d86bbda4e043df3ee6a5d5f6c5d72bb37cbe7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)