MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89b5cbceba8cb4610dddf81672e59c1a577415693749654f56302d15d99b5a34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

StrelaStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	89b5cbceba8cb4610dddf81672e59c1a577415693749654f56302d15d99b5a34
SHA3-384 hash:	c613cb265938fc6485971196e2479de15e631638ed4069cf23c04677f1c3ca5fb5e6a003835b058bf43e4b94fc6f1941
SHA1 hash:	765b856d42039998aea7f6b0a6e9676e07f68e19
MD5 hash:	a47d99ac9420c1ec6ceca35faf52137c
humanhash:	ten-dakota-asparagus-king
File name:	RG-2024-207_Wolfgang Weber_VCOM 2024_PVA Weber-Stocksberg.pdf
Download:	download sample
Signature	StrelaStealer Create hunting rule
File size:	2'407 bytes
First seen:	2025-01-23 23:16:17 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	48:9UKBtFlZvWm4378Ta6mB0diS5teKzY3oXVrEVqjKxqO7BmXN4B7u:aKBhw0n75BWoXVQVqGwO7oXN+u
TLSH	T1B8411A98EF4EDE00C615ED399F13EBB0925FB2821912420F6244DAD90E7A1881F5992F
Magika	zip
Reporter	cocaman
Tags:	pdf StrelaStealer zip

cocaman

Malicious email (T1566.001)
From: "Ilona Bergner <no-reply@dv-groupe.net>" (likely spoofed)
Received: "from dv-groupe.net (unknown [197.218.114.50]) "
Date: "Thu, 23 Jan 2025 23:15:25 +0000"
Subject: "Rechnung RG-2024-207 Jahresrechnung Portalzugang VCOM"
Attachment: "RG-2024-207_Wolfgang Weber_VCOM
2024_PVA Weber-Stocksberg.pdf"

Intelligence

File Origin

# of uploads :

# of downloads :

267

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	2477423425272303467.js
File size:	27'126 bytes
SHA256 hash:	2225145747ed5d8ed251921b754b1c39ac5d64dfa27f12ee9b7b5d4b2d32c952
MD5 hash:	2e29e782ff42bff71d9436b4375bfd7a
MIME type:	text/plain
Signature	StrelaStealer

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_jsnum225n.UNOFFICIAL

Gathering data

Result

Verdict:

Malicious

File Type:

JS File

Link:

https://app.docguard.net/89b5cbceba8cb4610dddf81672e59c1a577415693749654f56302d15d99b5a34/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6792cdf1f0727268592bed04/reports/63886fcc-c282-4b51-8f8e-348e29cc6825/overview

Verdict:

Malicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/89b5cbceba8cb4610dddf81672e59c1a577415693749654f56302d15d99b5a34

Score:

98%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)