MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04cd33590e930011dab53d3a8d3670d9306bcdd52cb0c4b7ee02f12efd4d7c14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04cd33590e930011dab53d3a8d3670d9306bcdd52cb0c4b7ee02f12efd4d7c14
SHA3-384 hash: 5e1442a6315725660cc0ba04a7ab8e8e8dff9f32a7886324cf32d2af9066d22c3ddaeea1f0b92e46c1dc2341146bade7
SHA1 hash: 1f8e1c2ba56d7c3049ad9bb448da14b45dc38991
MD5 hash: 1054f85d0888a8da16f4920b73997e1a
humanhash: dakota-lion-paris-venus
File name:SMS Logs.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:305'768 bytes
First seen:2021-01-27 07:33:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:tcVAv7fV7/TV9Zl0y6j2RHSlxAVEgQUgQ83ROAaeOM9icG2inlB6IfBcv:fhbVHl0yYcVM3QEROA9Oi+xlBnfC
TLSH 865423B12BC69C4DB023F8B65135C4D3F9E17E895B45762A66DC8C46C63C273ABB804C
Reporter fabjer
Tags:rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04cd33590e930011dab53d3a8d3670d9306bcdd52cb0c4b7ee02f12efd4d7c14/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2020-11-30 01:58:34 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=atgtgwiosmabdwvvhu5i2ntq3eygxtovfsymjn7oalys57knpqka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/04cd33590e930011dab53d3a8d3670d9306bcdd52cb0c4b7ee02f12efd4d7c14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 04cd33590e930011dab53d3a8d3670d9306bcdd52cb0c4b7ee02f12efd4d7c14

(this sample)

AveMariaRAT

Executable exe 1efc23c2527eb5ba80630a9610b6ef71709a90ed8f06716588b6fea6c4a55134

  
Dropping
SHA256 1efc23c2527eb5ba80630a9610b6ef71709a90ed8f06716588b6fea6c4a55134
  
Delivery method
Distributed via e-mail attachment

Comments