MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12dde6160f7a258dc741dad3116225cdc13f4c08ec7ff472a778526a7425d997. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12dde6160f7a258dc741dad3116225cdc13f4c08ec7ff472a778526a7425d997
SHA3-384 hash: 3ddc2c2dd79f6b3b2db8c7f1c2a29a715d5ef81659eda0e855bffc3aceb92d8f6a9ea540f3ccc837630903850ee6e9dd
SHA1 hash: afefe9c8d1f7a4be29b1bd2a2ada7d17b7eb28d0
MD5 hash: dc5c7e236fe4b7bea05706f092762eb6
humanhash: twelve-berlin-pip-wisconsin
File name:IMAGES AND SPECIFICATIONS - RFQ DTD5-08-20PDF.z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:288'582 bytes
First seen:2020-08-05 08:25:20 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:g03tESYlK//B/JYR5aN0N4Y9m/VRIOpE/8pQB0fq:VulCxJS5o0eTRg/gQBCq
TLSH CD54239A05DD8E264FD8EC5678984FB490D98905F9FEBC38DCFD820CE21D3A62975C20
Reporter abuse_ch
Tags:AveMariaRAT RAT z


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: medpex.com
Sending IP: 210.244.73.74
From: Aisha <6667hs@naver.com>
Subject: Product Inquiry - Canton Fair Person
Attachment: IMAGES AND SPECIFICATIONS - RFQ DTD 5-08-20PDF.z (contains "IMAGES AND SPECIFICATIONS - RFQ DTD 24-0720PDF.exe")

AveMairaRAT C2:
45.137.22.117:5200

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12dde6160f7a258dc741dad3116225cdc13f4c08ec7ff472a778526a7425d997/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:27:06 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=clo6mfqppisy3r2b3ljrcyrfzxat6tai5r77i4vhpbjgu5bf3glq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/12dde6160f7a258dc741dad3116225cdc13f4c08ec7ff472a778526a7425d997

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

z 12dde6160f7a258dc741dad3116225cdc13f4c08ec7ff472a778526a7425d997

(this sample)

AveMariaRAT

Executable exe e1b924fa9552fc6bccfe3134bd3930b41ddbb93854e4a82cd6df2344496e5948

  
Dropping
MD5 8371923593273e26a1ab99788b8da6f8
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1b924fa9552fc6bccfe3134bd3930b41ddbb93854e4a82cd6df2344496e5948

Comments