MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ddd91b77f463562d9ee3543b0e9ca9582c7645896549f7a96dde6821e62059. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30ddd91b77f463562d9ee3543b0e9ca9582c7645896549f7a96dde6821e62059
SHA3-384 hash: 43289c9fe43a05746e0e98a3dca75fdf6f2016903679c925b0b8f66ad019d2560a5f4c0616ddb517cdc0155b93d18a0d
SHA1 hash: cf2ed068fddde972337a4a221684aa571f949c29
MD5 hash: 73f50c3645d928e25b7c5c709750fe5c
humanhash: network-alpha-beryllium-social
File name:Transaction_Details.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:242'895 bytes
First seen:2020-08-08 17:58:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Il/xLJJ6LSwztacItIj+EjnyPxUESHTS8CjvNQsoTfgZ4RIQolBL:OVaWUtyIFsUfvYVQD7gZ4bo/
TLSH FC34230506A69BC533729E46FDEB96B31A75A1409707D9B74603C923D2EF08EAF1C47C
Reporter abuse_ch
Tags:AveMariaRAT rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.frehty.info
Sending IP: 157.245.229.28
From: Angela Lim <security@frehty.info>
Subject: Your Order is out for delivery
Attachment: Transaction_Details.rar (contains "Transaction_Details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30ddd91b77f463562d9ee3543b0e9ca9582c7645896549f7a96dde6821e62059/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 18:00:10 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gdo5sg3x6rrvmlm64nkdwdu4vfmcy5sfrfsut55jnxpgqipgebmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/30ddd91b77f463562d9ee3543b0e9ca9582c7645896549f7a96dde6821e62059

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 30ddd91b77f463562d9ee3543b0e9ca9582c7645896549f7a96dde6821e62059

(this sample)

AveMariaRAT

Executable exe 3d9346916b045c5d6641614a9657dcab88a2e667c7ad764fc281d4bf80a7746e

  
Dropping
MD5 bed5ba44eb5f618beaf24ab935d05c96
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d9346916b045c5d6641614a9657dcab88a2e667c7ad764fc281d4bf80a7746e

Comments