MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc672bd0d6291358bf8cf6a77faceee8a30ba6b5da24d45f3c6c5f8ca04f5537. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc672bd0d6291358bf8cf6a77faceee8a30ba6b5da24d45f3c6c5f8ca04f5537
SHA3-384 hash: 79914464a94e1e36e34d6677081fef652e7e5d773a8bad11f4de00ebe9420a12cdb5935936f6e2a05a2ce760ece4812b
SHA1 hash: a8c00afb78842bd7b3d120c201ad9015f0e39d61
MD5 hash: 4844c6494c0a38ef8bd08c58b6174ba7
humanhash: steak-quiet-solar-autumn
File name:quotation_20203107.xz
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:305'936 bytes
First seen:2020-07-31 06:21:53 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:IO0zrIHKRgabhqX/pF0KCSxZU0nNLa4ybjdkgFJ8rWZDTLqVGD9+uii2TnZJw0Ju:wVJM/H3/M4ybRvJ8KTL1liiynZHJu
TLSH 7954238EF19B04775B39EB78E0A0BCC7896CD074B408A58BC8ED4EB121D8549A77163F
Reporter abuse_ch
Tags:AveMariaRAT RAT xz


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp98.iad3a.emailsrvr.com
Sending IP: 173.203.187.98
From: Abdelilah Eldaai <abdelilah.eldaai@klenk.de>
Reply-To: abdelilah.eldaai@kienk.de
Subject: sv;新訂單
Attachment: quotation_20203107.xz (contains "quotation_20203107.exe")

AveMariaRAT C2:
ca-fax123.home-webserver.de:1050 (103.99.1.43)

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc672bd0d6291358bf8cf6a77faceee8a30ba6b5da24d45f3c6c5f8ca04f5537/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 06:23:08 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7rtsxugwfejvrp4m62tx7lho5crqxjvv3isnixz4nrpyzicpku3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc672bd0d6291358bf8cf6a77faceee8a30ba6b5da24d45f3c6c5f8ca04f5537

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

xz fc672bd0d6291358bf8cf6a77faceee8a30ba6b5da24d45f3c6c5f8ca04f5537

(this sample)

AveMariaRAT

Executable exe 955410f4b71705b2f92e643c9a93530e76939f85e6f51131276fac681c81b18b

  
Dropping
MD5 20d5c12eb0d09ee414dd8f065985d37e
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 955410f4b71705b2f92e643c9a93530e76939f85e6f51131276fac681c81b18b

Comments