MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82da6f876baac486a5d76fe718cb28fd215fa911e7fde68709618ce1ed4ba113. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

StrelaStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	82da6f876baac486a5d76fe718cb28fd215fa911e7fde68709618ce1ed4ba113
SHA3-384 hash:	3155325450e006935ae4d4e9245fcb092744334599ef05d8d1609371b33228cd52e824cbc3d6deaba23245811b8f02cc
SHA1 hash:	83b7e58f1959d9370780b56cff734a00a542d0d2
MD5 hash:	b54b2379c043ac2032bf5d377136c336
humanhash:	diet-yankee-rugby-bakerloo
File name:	Rechnung 422263.pdf
Download:	download sample
Signature	StrelaStealer Create hunting rule
File size:	2'307 bytes
First seen:	2025-01-13 12:53:06 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	48:9C3qSRsfPaaLSep0Uv6OJT3xJNY3ys2TdUEz6YQwEaUXjzqzMrUdC:6qSQ6evvr/NYgJUEz6YGzq4U0
TLSH	T1AA413B34100F54A4C87BD9B3B9D896891D294CC60F0711AA5855C8C38B8B0D19A959CF
Magika	zip
Reporter	cocaman
Tags:	pdf StrelaStealer zip

cocaman

Malicious email (T1566.001)
From: "Stefanie Haas <no-reply@vkzegbroek.be>" (likely spoofed)
Received: "from vkzegbroek.be (unknown [197.244.13.209]) "
Date: "Mon, 13 Jan 2025 12:52:06 +0000"
Subject: "=?utf-8?Q?Anbei_erhalten_Sie_Rechnung_422263_OP=2DLeuchte?=
=?utf-8?Q?_anschlie=C3=9Fen?="
Attachment: "Rechnung 422263.pdf"

Intelligence

File Origin

# of uploads :

# of downloads :

167

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	15994293462788625581.js
File size:	10'725 bytes
SHA256 hash:	19a15e3d06814624e84705dbc5824831efd2d68c606729e6f9ef141885ce6e7b
MD5 hash:	f6c506adbed2e7ab749d8c059a6e2484
MIME type:	text/plain
Signature	StrelaStealer

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_jsnum225n.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67850cebaa9c8e7858de7d5b

Tags:

n/a

Result

Verdict:

Clean

File Type:

JS File

Link:

https://app.docguard.net/82da6f876baac486a5d76fe718cb28fd215fa911e7fde68709618ce1ed4ba113/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated powershell webdav

Link:

https://www.filescan.io/uploads/67850cf29ae0ee7e9dea8a76/reports/511ba325-4018-4580-8bdf-ac051d491165/overview

Verdict:

Malicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/82da6f876baac486a5d76fe718cb28fd215fa911e7fde68709618ce1ed4ba113

Score:

99%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/250113-qqnevatlgx/

Behaviour

Command and Scripting Interpreter: JavaScript

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/82da6f876baac486a5d76fe718cb28fd215fa911e7fde68709618ce1ed4ba113

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)