MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a5a181ecc172751200fac657f9cb4cd93480a983996804579df187ddbde657b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a5a181ecc172751200fac657f9cb4cd93480a983996804579df187ddbde657b
SHA3-384 hash: 046273c4ca1cd8322c54dae15643c6fd1bcdc7cd44b2b0bd0dc1e1bc33c43a32e636ff516bc80db0039a3e57bf30a85a
SHA1 hash: ddf22b67b14a7c912ebe3113eb31477ccba050ab
MD5 hash: e065d2f829bb38d2f6a6d5a072f88042
humanhash: tennessee-london-cat-table
File name:Documentos internos de transferencia de dinero Banco Santader.arj
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:38'492 bytes
First seen:2020-10-27 16:42:16 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:/cg8+fVHL5VdN/WzSwHoaLnz7AGeQTlbFzsHJ94f5EQmw4hhK7WW:B9UzSmoKz7+slb9sHJ9E5N2Ef
TLSH B603F102D9CDB232023587159FAD225A5D21CDA6DD00EE69FC281D0AC15F05B8BECBEB
Reporter abuse_ch
Tags:arj AveMariaRAT ESP geo RAT Santander


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: h22.megalink.com
Sending IP: 200.75.160.22
From: Banco Santander S.A <xavier.m@caixabank.es>
Subject: SV:Transferencia de pago
Attachment: Documentos internos de transferencia de dinero Banco Santader.arj (contains "Documentos internos de transferencia de dinero Banco Santader.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.31443.25634.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a5a181ecc172751200fac657f9cb4cd93480a983996804579df187ddbde657b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 14:58:50 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fjnbqhwmc4tvciapvrsx7hfuzwjuqcuyhgliarlz34mh3w66mv5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a5a181ecc172751200fac657f9cb4cd93480a983996804579df187ddbde657b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

arj 2a5a181ecc172751200fac657f9cb4cd93480a983996804579df187ddbde657b

(this sample)

AveMariaRAT

Executable exe aae06c61ea30fd920db8caa7e32eefe1b74842affe3fa6d53ce6765f49783ed5

  
Dropping
MD5 e1726ebde2d09435b5709a6b7a1d1d16
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aae06c61ea30fd920db8caa7e32eefe1b74842affe3fa6d53ce6765f49783ed5

Comments