MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8633db06dc197aa3853f6e6d0cb9fa9b02e50b03879a99d86019a6829ba9d830. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8633db06dc197aa3853f6e6d0cb9fa9b02e50b03879a99d86019a6829ba9d830
SHA3-384 hash: 47c89fd4121e0c923c4f18fe8dce228ee73afbc4610f1b2ce45cfb6c05a810af4cb50f4e9208bdb6f917da40359f4bfc
SHA1 hash: 954e8c9c0cfbb81a010a139c67393130c622cd28
MD5 hash: b6ae9830e3dfc07a12a1979c043bdcad
humanhash: lactose-july-princess-may
File name:ORDER_GB48394.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:400'963 bytes
First seen:2020-07-30 10:43:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:9NfL6gHyRTw23iM/Das87ZwR0KGYFQzMY2g9YGJTwBDnqcR01C/e:912CyRw23tDas8K0K2zMbgdUpo1Ce
TLSH 8B8423145ABDDF6F2C1AC47526ED5A4E63529B8240A5F05DDB83772D387BEC84B3C808
Reporter abuse_ch
Tags:AveMariaRAT Endurance zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-206-47.unifiedlayer.com
Sending IP: 162.241.206.47
From: Jain ( Alum Fabrics) <info@megatroncitrone.com>
Reply-To: Jain ( Alum Fabrics) <secdir@edleuros.com>
Subject: Re: new order
Attachment: ORDER_GB48394.zip (contains "ORDER_GB48394.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8633db06dc197aa3853f6e6d0cb9fa9b02e50b03879a99d86019a6829ba9d830/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-30 10:45:07 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qyz5wbw4df5khbj7nzwqzop2tmbokcydq6njtwdadgtifg5j3aya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8633db06dc197aa3853f6e6d0cb9fa9b02e50b03879a99d86019a6829ba9d830

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 8633db06dc197aa3853f6e6d0cb9fa9b02e50b03879a99d86019a6829ba9d830

(this sample)

AveMariaRAT

Executable exe 3ac41aaeb5772f77fa5e3c6bfaeecc906430b37abb0b7d3be40adc87b0d57e1d

  
Dropping
MD5 1021003d26578c68f1e191061055d660
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ac41aaeb5772f77fa5e3c6bfaeecc906430b37abb0b7d3be40adc87b0d57e1d

Comments