MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59123ef1864bbb319e83fa6dbb956c1b8441be489876552059433a5fda502b39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59123ef1864bbb319e83fa6dbb956c1b8441be489876552059433a5fda502b39
SHA3-384 hash: 99e4c894f173e9efb211297e25e912a4decc6e59a2d7b2a6f150b6666a9e56a35a7f1cf71428eddf3953f5e514dc2511
SHA1 hash: e21ffeef4fe8e7fb28515c6d96d26572aa0afa48
MD5 hash: a3f9e143e70e638508cf40e443aa10df
humanhash: seventeen-stairway-oscar-uniform
File name:PO 051820.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:139'451 bytes
First seen:2020-05-19 04:47:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:9iBji5ep6PquHbwzc+OPX+vqSJx3AIh1JG4aJmP3Vmhv8K:9i9npjg+vqw1TNt263VmRp
TLSH 6FD3125E50450B9BA8DDDF334591F20DD381D32C28E884207969A1AF7BE867D06E3B7E
Reporter cocaman
Tags:AveMariaRAT rar


Avatar
cocaman
Malicious email
From: "Dennis Tan" <admin@inouteg.com>
Received: from mail.avant-garde.co.in (host130.managedbiz.net [59.160.116.130])
Date: 18 May 2020 13:56:20 -0700
Subject: RES: PO 051820
Attachment: PO 051820.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Avemaria
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 21:20:27 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lejd54mgjo5tdhud7jw3xflmdocedpsitb3fkiczim5f7wsqfm4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 59123ef1864bbb319e83fa6dbb956c1b8441be489876552059433a5fda502b39

(this sample)

AveMariaRAT

Executable exe 2289f866656b87504cc600b2549dfedde7a546b79ee931e1f50e6ab91cd86a9a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2289f866656b87504cc600b2549dfedde7a546b79ee931e1f50e6ab91cd86a9a
  
Dropping
AveMariaRAT

Comments