MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f0268c42f3d96696160b7ad707a939450cfc0206ea38d1115246fd523831ec5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f0268c42f3d96696160b7ad707a939450cfc0206ea38d1115246fd523831ec5
SHA3-384 hash: b4d18531812693dfd09ce71411ef6438f00f8b2009a4b52bfb14dbd28ec4fe261850cdc1557b785e08ab7fc78ee79cda
SHA1 hash: 5c4d2240aebdca31e6b2da8f809034dc8add6991
MD5 hash: b5e21242c608c935bc8031301076f6de
humanhash: four-black-cup-virginia
File name:Documentos de pago bancario 36587634 Bisa2020.arj
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:56'120 bytes
First seen:2020-10-22 06:24:22 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:xoiEe9SEWUNTWRbuKLeklkZbx0zSEYYE64kE41fikYDap1kj0k1OAmIeSd:CirSEW0iRPTwlvSNBY+vkQkIA+8
TLSH 964302EEA5E4B0440F939DF1E11C66CF23191074BD8B66207F27AABADED182285777D0
Reporter abuse_ch
Tags:arj AveMariaRAT ESP geo RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mx1.e-tiger.net
Sending IP: 193.23.139.20
From: Banco BISA S.A <no-reply@posta.hu>
Subject: Rv:Transferencia de dinero
Attachment: Documentos de pago bancario 36587634 Bisa2020.arj (contains "Documentos de pago bancario 36587634 Bisa2020.exe")

AveMariaRAT C2:
178.170.138.163:4554

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.19390.22399.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f0268c42f3d96696160b7ad707a939450cfc0206ea38d1115246fd523831ec5/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b4bgrrbphwlgsylaw6wxa6utsrim7qban2ry2eiverx5ki4dd3cq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

arj 0f0268c42f3d96696160b7ad707a939450cfc0206ea38d1115246fd523831ec5

(this sample)

AveMariaRAT

Executable exe b8ab1b11519bc6b1e834b01d385b9b15a297d05533eec1ea6f89fa0576370f24

  
Dropping
MD5 d0285d36a543c2601ffdb5b3133b0b62
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8ab1b11519bc6b1e834b01d385b9b15a297d05533eec1ea6f89fa0576370f24

Comments