MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 352c88e20cb88151e685058b23e85c22c7e607f9dbc610a9f091af6018899c70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 352c88e20cb88151e685058b23e85c22c7e607f9dbc610a9f091af6018899c70
SHA3-384 hash: 2099e15223110e0c6244bbf3668324134565e1fe903124505f56ee1e3a036605aef887a73a38799319c32524839c8242
SHA1 hash: 4b692410a4f6b80072636a63a6b9a1b3e3684043
MD5 hash: 227c9b832032b41913ad7cc3878256c7
humanhash: blossom-hamper-lithium-stairway
File name:DOC1118364.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:427'769 bytes
First seen:2020-09-15 07:09:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:/vrUKc6aocYhUSKaNAbDH4dM+Rz8aeKbsM:/vrUKc6aocYhUSKaN8DH+M+98arbP
TLSH 8494235876BA8CD2B4640DC8645C62092E7E5202C796E52E0677374FAC72F0EDF2E71A
Reporter GovCERT_CH
Tags:AveMariaRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/352c88e20cb88151e685058b23e85c22c7e607f9dbc610a9f091af6018899c70/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 23:21:26 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=guwiryqmxcavdzufawfsh2c4eld6mb7z3pdbbkpqsgxwagejtrya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/352c88e20cb88151e685058b23e85c22c7e607f9dbc610a9f091af6018899c70

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 352c88e20cb88151e685058b23e85c22c7e607f9dbc610a9f091af6018899c70

(this sample)

AveMariaRAT

Executable exe df6b12e28602092e6841be50355a76684b5333b236cf9b8441dd73fc1abbf4ae

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df6b12e28602092e6841be50355a76684b5333b236cf9b8441dd73fc1abbf4ae
  
Dropping
MD5 d5b0e55b8f079ecb68617895537b90a5

Comments