MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af
SHA3-384 hash:	0834827526de20c0a2bb0231627b07ec896f7cb929ecdbb2f5a85e5c5dfa0a1e814c83fc2ee4fcdf98733fafd545a406
SHA1 hash:	4795284dca7c5434ebaa6b27dcc9aa1d754705d4
MD5 hash:	b0dfb089985cc2ea8a5752c2e2833512
humanhash:	stairway-golf-north-william
File name:	28236151432955330765.js
Download:	download sample
Signature	StrelaStealer Alert Create hunting rule
File size:	10'361 bytes
First seen:	2025-01-14 09:53:26 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:tjOXqrQREU5OffjIBkBheE94LT9EjI46h9jIT6hw78TGIGGk6GyoYdmkOU5jzdDp:5ceQREU5UI2BheE94LT9KI46/IT6yjI7
TLSH	T1162284BCFAD9CB87ACD138FF4248D47401EE62D5C91DA0C099938E0999DB760D6DE930
Magika	javascript
Reporter	cocaman
Tags:	js StrelaStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

462

Origin country :

CH

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.75354062.20632.14339.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6786343b4487910100decef0

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated powershell webdav

Link:

https://www.filescan.io/uploads/6786344433837f9f2abfe40d/reports/a3097434-f514-4e41-8350-f883ae6045f4/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af

Joe Sandbox Strela Downloader

Result

Threat name:

Strela Downloader

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1590607

Signature

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Strela Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af/

ReversingLabs TitaniumCloud Script-JS.Trojan.StrelaStealer

Threat name:

Script-JS.Trojan.StrelaStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-14 01:03:46 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zvruiiydkkl5ym7eoa5guzjd4tt3iy5iwjcrv27t4wgprfcl46xq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/250114-lw7nfsvmct/

Behaviour

Command and Scripting Interpreter: JavaScript

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af