MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 058ff8b07bee9b0ac5a0c4ffb66cd161227859f0af5326126d1a9ce50fc9bcb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 058ff8b07bee9b0ac5a0c4ffb66cd161227859f0af5326126d1a9ce50fc9bcb8
SHA3-384 hash: 8803f792882c03ad8b5eea10943a86ff6d595cb82267a6328985a281576082549d215dfb83a2b409a30e1f4d58213802
SHA1 hash: e7ee4f666ccafd81ab2fb0b779d06dad9f485955
MD5 hash: 04ad0d2bd40bb57e66d7d827d4afe38d
humanhash: single-don-eight-social
File name:E745DH.alibaba.r08
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:282'490 bytes
First seen:2020-07-10 09:24:27 UTC
Last seen:Never
File type: r08
MIME type:application/x-rar
ssdeep 6144:ZKoxl98u3HLWqTA7eqbDOZgQS/7lEZ6J77vHtmCOoZzUi/Aox:8oX2Ayqk7eqbDa0/7akBvHY9oZAyAU
TLSH CC5423D31DF956D66C01CE2AF994E79B4A822EDEC6049BA50731B18ECD6930CF24DCA1
Reporter abuse_ch
Tags:AveMariaRAT Endurance r08 RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: qproxy2.mail.unifiedlayer.com
Sending IP: 69.89.16.161
From: Marcello <baiju@easternimpex.com.cn>
Subject: RE: D4509J
Attachment: E745DH.alibaba.r08 (contains "E745DH.alibaba.com")

AveMairaRAT C2:
46.183.221.107:4082

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/058ff8b07bee9b0ac5a0c4ffb66cd161227859f0af5326126d1a9ce50fc9bcb8/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 09:26:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=awh7rmd352nqvrnayt73m3grmerhqwpqv5jsmetndkookd6jxs4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

r08 058ff8b07bee9b0ac5a0c4ffb66cd161227859f0af5326126d1a9ce50fc9bcb8

(this sample)

AveMariaRAT

Executable exe aa509d1b61485ca731f996f34538a4ee467cff6ccbfb215f261b4ebe5d655ce8

  
Dropping
MD5 430aecffce91b67ab23911a1b3401114
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aa509d1b61485ca731f996f34538a4ee467cff6ccbfb215f261b4ebe5d655ce8

Comments