MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 014a7e6311820a8ee9ab2d9bc4e080bc2866acdb54ccbc37d9a7a2154d41bd50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 014a7e6311820a8ee9ab2d9bc4e080bc2866acdb54ccbc37d9a7a2154d41bd50
SHA3-384 hash: ac91512e7a819e595c480b1262f0b6f0bf18037c110663e11a76cefb30dc346c51a12121d9811d071da04c95173c03b2
SHA1 hash: d1dde3c8e58ad7c4821e5e4e187d1761cdcb5dec
MD5 hash: 812be8ea79b600adad35db4ae69615ba
humanhash: failed-vermont-colorado-cola
File name:RFQ 08172020 Pangulf Group,pdf.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:180'216 bytes
First seen:2020-08-18 13:25:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:iiVi8vONnv+rbCtAgSraEuG6Y/QlBMuePT+pOey1SNR39lpp0+zpdtWMHgXk+:9Vi8K1AXra7G9/UBMdAW1SNR39lZdtJW
TLSH 1F0423E104A95615D2CD25DC23386ACE148E36FCEFD90324854777F9536FAAF186027B
Reporter abuse_ch
Tags:AveMariaRAT rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp01-sa.serv.net.mx
Sending IP: 201.150.39.117
From: pakmail220mx@pakmail.com.mx
Subject: RFQ 08172020 | Pangulf Group
Attachment: RFQ 08172020 Pangulf Group,pdf.rar (contains "RFQ 08172020 Pangulf Group,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/014a7e6311820a8ee9ab2d9bc4e080bc2866acdb54ccbc37d9a7a2154d41bd50/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:27:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=affh4yyrqifi52nlfwn4jyeaxqugnlg3ktglyn6zu6rbktkbxvia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/014a7e6311820a8ee9ab2d9bc4e080bc2866acdb54ccbc37d9a7a2154d41bd50

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 014a7e6311820a8ee9ab2d9bc4e080bc2866acdb54ccbc37d9a7a2154d41bd50

(this sample)

AveMariaRAT

Executable exe d045c6b114f25c29811bbb61864da2f464c9d5195b54d70008b7bbf91384b47f

  
Dropping
MD5 c768be9c3c6b827c59eb76e7bb7bac72
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d045c6b114f25c29811bbb61864da2f464c9d5195b54d70008b7bbf91384b47f

Comments