MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2faeb0c20a5bf79a51cb6d10c65754c0d0ea55801ead7734050d9bb9665c8cef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2faeb0c20a5bf79a51cb6d10c65754c0d0ea55801ead7734050d9bb9665c8cef
SHA3-384 hash: 36ac1d20d97153028b29179cf9ad7a202f2407cbc7475d65f64f4c365ec3d05d116af77a7cb1ae36958a2571ec063efe
SHA1 hash: 2b317dedeb3b9ed181ed34aaa83609f26bef693b
MD5 hash: 34cd1d7d5663cef49d05a46e37ec0e3c
humanhash: south-twelve-carbon-kitten
File name:order 20201012.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:299'195 bytes
First seen:2020-10-12 08:47:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ZodKCR5sWvOLjLfP+2ONCFW2z1PCzEM7b/h0PNZ0ik:Z6KCR5sJLfP+2OgW2z1K2C
TLSH 6F5412DAB69832C0EAF8E0132BD1FBA0CD6A42BE5FD566DB3B004B75BD1444ADC64534
Reporter abuse_ch
Tags:AveMariaRAT RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mail.gxecard.com
Sending IP: 117.141.142.7
From: Zunzar Vitthalrao Kedar<zunzar.rurutek@mail.com>
Subject: New order #20201012
Attachment: order 20201012.zip (contains "order #20201012.exe")

AveMariaRAT C2:
minekroft.duckdns.org:5200 (193.169.253.181)

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2faeb0c20a5bf79a51cb6d10c65754c0d0ea55801ead7734050d9bb9665c8cef/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 07:31:22 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6xlbqqklp3zuuolnuimmv2uydiouvmad2wxonafbwn3szs4rtxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2faeb0c20a5bf79a51cb6d10c65754c0d0ea55801ead7734050d9bb9665c8cef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 2faeb0c20a5bf79a51cb6d10c65754c0d0ea55801ead7734050d9bb9665c8cef

(this sample)

AveMariaRAT

Executable exe 1ac79d82fcb1c46ddd8b991e5daad4c48b1a2916b41aa6e851afeddd088f24fe

  
Dropping
MD5 554c38012af33626854e45f440ab0b0c
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ac79d82fcb1c46ddd8b991e5daad4c48b1a2916b41aa6e851afeddd088f24fe

Comments