MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b163004e067a5fb9aece369e536cee93dfb0dcd72c3fdd641b1fdacdd1d6b914. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b163004e067a5fb9aece369e536cee93dfb0dcd72c3fdd641b1fdacdd1d6b914
SHA3-384 hash: 1f64b36258730984d5cd125fadc86d6a4052bb877d07b93aaf59bbb94785095938a88aa5b75fe4e2b1b020fd7bc4cbf5
SHA1 hash: 2b63dd1fe5dac6fba0bbb4f553d504bbd7de7800
MD5 hash: 9044b3b2ea6e1da700d7e931dd61f1e1
humanhash: apart-mike-solar-river
File name:RFQ For P.T Int 40803788200019 ,pdf.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'750'144 bytes
First seen:2020-05-06 16:35:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:qMJrrUv+IcBYFkVYe+DLANpW3pTEEzJRzdC8x:9rYhLLKW3pgEjxC8x
TLSH 7E85338E2FF9AFD6DB1B2A5C408C5873629F8BD2634160A62BA877D5031393C7D4E474
Reporter abuse_ch
Tags:AveMariaRAT rar


Avatar
abuse_ch
Malspam distributing :

HELO: gmail.com
Sending IP: 103.133.111.162
From: Olivia Whiston <oliviawhistonwhiston@gmail.com>
Subject: URGENT ORDER RFQ #218B
Attachment: RFQ For P.T Int 40803788200019 ,pdf.rar (contains "RFQ For P.T Int #40803788200019 ,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 17:36:37 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wfrqatqgpjp3tlwog2pfg3hospp3bxgxfq752za3d7nm3uowxeka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar b163004e067a5fb9aece369e536cee93dfb0dcd72c3fdd641b1fdacdd1d6b914

(this sample)

AveMariaRAT

Executable exe 5136cc442f7ff2a99cb5c3c64c0419d23a3aba57f7389af3a758615eb8b6d26b

  
Dropping
MD5 a41fdbd40b07e4cec71b57868db22eaf
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5136cc442f7ff2a99cb5c3c64c0419d23a3aba57f7389af3a758615eb8b6d26b

Comments