MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30b9668e83e77cf20cf419c87d7703a0df6c6fcb6cf6c980987cc03a170bd926. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30b9668e83e77cf20cf419c87d7703a0df6c6fcb6cf6c980987cc03a170bd926
SHA3-384 hash: d3bfc56786a1873ae05d5ea13ee006ad27013ff334b3bb159d76a5ae88fc5788ba92874b61913a89502f89238835f488
SHA1 hash: 8126ff5a5e3933648d1a49293a661d65f06ffcc4
MD5 hash: 4349d145140185f4a18e6041fc6d4b15
humanhash: minnesota-magnesium-shade-yellow
File name:Quotation-Design.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:374'851 bytes
First seen:2020-05-09 06:39:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:NW/m4d5VE4V1MRt15LM+48o9hwo+l2pGH74SebIsHZTMUmF1hHfFXuX8tanAFpWo:v4l9VCDjLn48orwdETDZrmFNDKqR
TLSH BC84237D72C9832245E87D1B41EF321779570CAC1BD23F942BA998B12926E229F1CFD1
Reporter abuse_ch
Tags:AveMariaRAT rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: adtelweb.org
Sending IP: 45.249.91.173
From: Store<info@adtelweb.org>
Subject: Fw: Quotation Design
Attachment: Quotation-Design.rar (contains "Design-Picture.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 07:35:45 UTC
File Type:
Binary (Archive)
Extracted files:
97
AV detection:
14 of 48 (29.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gc4wndud456pedhudheh25ydudpwy36lnt3mtaeyptadufyl3eta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 30b9668e83e77cf20cf419c87d7703a0df6c6fcb6cf6c980987cc03a170bd926

(this sample)

AveMariaRAT

Executable exe aa1de2e65be7572bdcc37b22c2c2f9be31ee5920d41174bfd18b2c2b7fabc6b9

  
Dropping
MD5 b4d3ec5cad3029bb5b6b7cd0cd3c856b
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aa1de2e65be7572bdcc37b22c2c2f9be31ee5920d41174bfd18b2c2b7fabc6b9

Comments