MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9af65de22ee3fb74829185b510959e5e9d54edf4f743f73f4a4b47ac16cf79a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9af65de22ee3fb74829185b510959e5e9d54edf4f743f73f4a4b47ac16cf79a
SHA3-384 hash: b8a54437e358f1fc0d50a53bca7681bbfc7fcc48b1d87085e3a95459879b93e3871dbccabc19d3a13e2d64dc545599ed
SHA1 hash: 7cf90e7e069ea4261ffa3d18ffa22eddb41afcb8
MD5 hash: cd6b2771cf276e7a5e1709fa7d071acf
humanhash: utah-single-ten-hot
File name:Shipping.doc2020081234567.xz
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:267'702 bytes
First seen:2020-08-12 05:54:41 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:i+T0/iQWWILKOMIkLqhCSA75m4zxK4CMyNIE4d:i+T0/HzvKA7r1ENS
TLSH 364422411A163E4F7FA65A763044F8BA60C714EE7E2F258DC4B3870CB6B99D2C921A17
Reporter abuse_ch
Tags:AveMariaRAT RAT xz


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp90.iad3a.emailsrvr.com
Sending IP: 173.203.187.90
From: sarah.zheng <sarah.zheng@fleetpride.com.cn>
Reply-To: sarah.zheng@fleatpride.com
Subject: Track your package
Attachment: Shipping.doc2020081234567.xz (contains "Shipping.doc2020081234567.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9af65de22ee3fb74829185b510959e5e9d54edf4f743f73f4a4b47ac16cf79a/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 05:56:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgxwlxrc5y73osbjdbnvcckz4xu5ktw7j52d647uus2hvqlm66na._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b9af65de22ee3fb74829185b510959e5e9d54edf4f743f73f4a4b47ac16cf79a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

xz b9af65de22ee3fb74829185b510959e5e9d54edf4f743f73f4a4b47ac16cf79a

(this sample)

AveMariaRAT

Executable exe cc6a2ab54544d8044166111bda55ec6273fddbb3132c09fbaaafb5f40b669ebe

  
Dropping
MD5 bc5272b9f087bff6efa17364ac7a4e07
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc6a2ab54544d8044166111bda55ec6273fddbb3132c09fbaaafb5f40b669ebe

Comments