MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7053ae46b5f20e512a5af04791caad3a8d1c9e1197e7284b227b0ed32a935d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7053ae46b5f20e512a5af04791caad3a8d1c9e1197e7284b227b0ed32a935d9
SHA3-384 hash: e616d93bb01a475f1989143a6467aac6b36f098e46134a0875eeee20bb5730cb26651842acc73231570e4062f9dc7207
SHA1 hash: 85e5b84eb017e72c3cfac098f4370ee533a5984a
MD5 hash: d2ce894781b993628b9df52040b21553
humanhash: yellow-ack-saturn-salami
File name:New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.7z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:333'645 bytes
First seen:2020-08-06 06:35:51 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:58H1yzxnFUYl7RDWgtSMQ0FSpZ4oRCi6b1ygq4UbsifU/l5kS:5CinFnDRtSMbFc426fqqic/l5kS
TLSH 206423D1FB074AE4F9757ED66A10AF89790417790A4382C7E92ECEB0C949F5823C2D27
Reporter abuse_ch
Tags:7z AveMariaRAT geo KOR RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mail-smail-vm41.hanmail.net
Sending IP: 203.133.180.229
From: 천사 <hylee30802@daum.net>
Subject: 새로운 구매 주수/샘플 및 사양
Attachment: New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.7z (contains "New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.exe")

AveMariaRAT C2:
54369253290033.sytes.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7053ae46b5f20e512a5af04791caad3a8d1c9e1197e7284b227b0ed32a935d9/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:37:06 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=24ctvzdll4qokevfv4chshfk2oundspbdf7hfbfse6yo2mvjgxmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d7053ae46b5f20e512a5af04791caad3a8d1c9e1197e7284b227b0ed32a935d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

7z d7053ae46b5f20e512a5af04791caad3a8d1c9e1197e7284b227b0ed32a935d9

(this sample)

AveMariaRAT

Executable exe 3785c1c5566cb064532d7573da4d6dc466977ba524ea961b275edfc7eb5cc925

  
Dropping
MD5 41be7bff1067ccceecdab9850b54fd5e
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3785c1c5566cb064532d7573da4d6dc466977ba524ea961b275edfc7eb5cc925

Comments