MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10476fa66ee21f1bdebfba4d9658e59f2e419f6114d86d989ed829e0d21bd5ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10476fa66ee21f1bdebfba4d9658e59f2e419f6114d86d989ed829e0d21bd5ea
SHA3-384 hash: 6cd4ca45c6f36c2225bbb2c51ef0ac4bcfe08b545167a5e5831896859ff4cdf4b75129459c9b6a67c90ab912552778b2
SHA1 hash: 714c2c9d773e7c7791a38eac0964f317cda5883e
MD5 hash: 6d079576e8df4f96a62447ee1b6a886c
humanhash: black-carpet-oscar-lima
File name:FIR,PDF.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:270'045 bytes
First seen:2020-10-12 14:44:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Pkaiauhn8asS7AW5jNeaDVe0XWmnBLoJz4dU9pkUVqyy1w:Pp4npsyAGkKVRWsZ7dU40SC
TLSH 6D442334B8678FB1DBD0B0A22A6B13C2D13D2DDFC26B7A3A597FA314A47C02151E494C
Reporter abuse_ch
Tags:AveMariaRAT rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: GEHLOT.home
Sending IP: 103.224.240.224
From: cybercell.ned <cybercell.ned@delhipolice.gov.in>
Subject: FIR - Cybercell.ned
Attachment: FIR,PDF.rar (contains "FIR,PDF.SCR")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10476fa66ee21f1bdebfba4d9658e59f2e419f6114d86d989ed829e0d21bd5ea/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 11:23:03 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cbdw7jto4iprxxv7xjgzmwhft4xedh3bctmg3ge63au6buq32xva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/10476fa66ee21f1bdebfba4d9658e59f2e419f6114d86d989ed829e0d21bd5ea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 10476fa66ee21f1bdebfba4d9658e59f2e419f6114d86d989ed829e0d21bd5ea

(this sample)

AveMariaRAT

Executable exe a5e7f494eb61368332811160955db5ef4dc5f07e6e3fbc7d5c0776023d3714c0

  
Dropping
MD5 38531dc63800e148f1c7af06a9c29979
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a5e7f494eb61368332811160955db5ef4dc5f07e6e3fbc7d5c0776023d3714c0

Comments