🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad
SHA3-384 hash: 4a75741b32413e3a941b045965c4610270ab01905f6c87edee7aa1af24afd7ba8fce2ed720e26dc3ee02bb57a1b210d3
SHA1 hash: a7dcf4eb3648aa45d4816ed751f6b7e408ce216c
MD5 hash: 6daa8287b3058f6c4ee92df17f471751
humanhash: emma-triple-social-magazine
File name:POP2.js
Download: download sample
Signature STRRAT
Create hunting rule
File size:1'874'592 bytes
First seen:2025-09-18 07:13:50 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:s71Sx5aLaBHojppEazEuoayPghOIPj6OFs4R9LWsR/:yguzs4RPd
TLSH T1C785AE51EB844B9D7298092BE07C492EB7F25F0BE4E375CD2B537E0B295FE0C6219984
Magika javascript
Reporter abuse_ch
Tags:js RAT STRRAT

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
51.79.62.89:3512 https://threatfox.abuse.ch/ioc/1593822/

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cbb17488b954439247aa39
Tags:
vmdetect shell spawn sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 dropper evasive expired-cert obfuscated obfuscated obfuscated
Link:
https://www.filescan.io/uploads/68cbb25c73287948292e7117/reports/1047b30f-a960-4c99-9883-ee25f20c975a/overview
Verdict:
Malicious
Labled as:
GT:JS.Divergent.3
Link:
https://www.hybrid-analysis.com/sample/d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad
Verdict:
Malicious
File Type:
js
First seen:
2025-09-18T04:17:00Z UTC
Last seen:
2025-09-18T04:17:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad/results?tab=lookup
Result
Threat name:
Nanocore, DarkTortilla, STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1779842
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates autostart registry keys to launch java
Creates multiple autostart registry keys
Detected Nanocore Rat
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Startup Folder Persistence
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
Uses dynamic DNS services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected AllatoriJARObfuscator
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected Nanocore RAT
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1779842 Sample: POP2.js Startdate: 18/09/2025 Architecture: WINDOWS Score: 100 120 takersjavby.duckdns.org 2->120 122 str-master.pw 2->122 124 5 other IPs or domains 2->124 134 Suricata IDS alerts for network traffic 2->134 136 Found malware configuration 2->136 138 Malicious sample detected (through community Yara rule) 2->138 142 19 other signatures 2->142 12 wscript.exe 4 3 2->12         started        16 svchost.exe 2->16         started        18 svchost.exe 1 1 2->18         started        21 7 other processes 2->21 signatures3 140 Uses dynamic DNS services 120->140 process4 dnsIp5 108 C:\Users\user\AppData\Local\Temp\svchost.js, ASCII 12->108 dropped 110 C:\Users\user\AppData\Local\Temp\adobe.js, ASCII 12->110 dropped 154 Benign windows process drops PE files 12->154 156 JScript performs obfuscated calls to suspicious functions 12->156 158 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->158 23 wscript.exe 2 12->23         started        26 wscript.exe 2 2 12->26         started        160 Changes security center settings (notifications, updates, antivirus, firewall) 16->160 28 MpCmdRun.exe 16->28         started        126 127.0.0.1 unknown unknown 18->126 file6 signatures7 process8 file9 96 C:\Users\user\AppData\Local\Temp\QNaZg.exe, PE32 23->96 dropped 30 QNaZg.exe 4 23->30         started        98 C:\Users\user\AppData\Local\Temp\PHat.jar, Composite 26->98 dropped 33 javaw.exe 22 26->33         started        36 conhost.exe 28->36         started        process10 dnsIp11 162 Antivirus detection for dropped file 30->162 164 Detected Nanocore Rat 30->164 166 Hides that the sample has been downloaded from the Internet (zone.identifier) 30->166 168 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 30->168 38 cmd.exe 30->38         started        41 cmd.exe 30->41         started        114 github.com 140.82.116.3, 443, 49716 GITHUBUS United States 33->114 116 release-assets.githubusercontent.com 185.199.109.133, 443, 49718 FASTLYUS Netherlands 33->116 118 dualstack.sonatype.map.fastly.net 199.232.192.209, 443, 49713, 49714 FASTLYUS United States 33->118 44 java.exe 33->44         started        signatures12 process13 file14 144 Uses ping.exe to sleep 38->144 146 Uses schtasks.exe or at.exe to add and modify task schedules 38->146 148 Uses ping.exe to check the status of other devices and networks 38->148 46 reg.exe 38->46         started        49 conhost.exe 38->49         started        51 PING.EXE 38->51         started        100 C:\Users\user\AppData\Roaming\word\word.exe, PE32 41->100 dropped 53 conhost.exe 41->53         started        55 PING.EXE 41->55         started        57 PING.EXE 41->57         started        102 C:\Users\user\...\jna8402568150371773399.dll, PE32 44->102 dropped 104 C:\Users\user\AppData\Roaming\PHat.jar, Composite 44->104 dropped 106 C:\Users\user\AppData\Roaming\...\PHat.jar, Composite 44->106 dropped 150 Creates autostart registry keys to launch java 44->150 152 Creates multiple autostart registry keys 44->152 59 java.exe 44->59         started        63 cmd.exe 44->63         started        65 conhost.exe 44->65         started        signatures15 process16 dnsIp17 170 Creates multiple autostart registry keys 46->170 128 takersjavby.duckdns.org 51.79.62.89, 3512, 49726 OVHFR Canada 59->128 130 ip-api.com 208.95.112.1, 49728, 80 TUT-ASUS United States 59->130 132 str-master.pw 5.79.71.225, 80 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 59->132 112 C:\Users\user\...\jna4386193800971018479.dll, PE32 59->112 dropped 67 cmd.exe 59->67         started        69 cmd.exe 59->69         started        71 cmd.exe 59->71         started        77 2 other processes 59->77 73 conhost.exe 63->73         started        75 schtasks.exe 63->75         started        file18 signatures19 process20 process21 79 WMIC.exe 67->79         started        82 conhost.exe 67->82         started        84 conhost.exe 69->84         started        86 WMIC.exe 69->86         started        88 conhost.exe 71->88         started        90 WMIC.exe 71->90         started        92 conhost.exe 77->92         started        94 WMIC.exe 77->94         started        signatures22 172 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 79->172
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad
Verdict:
inconclusive
YARA:
1 match(es)
Link:
https://app.malva.re/file/6daa8287b3058f6c4ee92df17f471751
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad/
Threat name:
Script-JS.Trojan.Divergent
Create hunting rule
Status:
Malicious
First seen:
2025-09-18 07:27:45 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tajoqjkwbldbzwls62ujxd4bihchcsl35ohtwthtr2ul6wofwwq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
error
STRRAT
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:darktortilla family:strrat crypter discovery execution loader persistence stealer trojan
Link:
https://tria.ge/reports/250918-h5dj7asvg1/
Behaviour
Modifies registry class
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Detect jar appended to MSI
Darktortilla
Darktortilla family
Detects Darktortilla crypter.
STRRAT
Strrat family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:SUSP_Double_Base64_Encoded_Executable_RID34CC
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments