MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35eca6e2b3061f51a6676b59e345da69de46302cd7dee364700492831749d539. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35eca6e2b3061f51a6676b59e345da69de46302cd7dee364700492831749d539
SHA3-384 hash: 496a36be8db562a829d7974be11760f315974a93332935d141baf76ef4dc67e307c751b30dd8f7acda4508e839a1e121
SHA1 hash: 58a1f079e41951620050ea3c36fe5ba70af83aa8
MD5 hash: e238d0c138b1d73e79adb6163e379b5e
humanhash: iowa-undress-artist-sweet
File name:11091181717661515151.cab
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:178'011 bytes
First seen:2021-01-30 12:57:10 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 3072:/3/sAuYWcvFPvpeu0JVE+9PaQN+MgYsMsPGU17RzNI1GAvt9CKr+kua6DBRFgjxA:/vluKFWLF9N+fMgFzNIlvtokuzGxkZ2q
TLSH 670422A2F2A50C0BF573A5E8C5C46DC2390A65B678D1CF653B87B8534CF22386614DEB
Reporter abuse_ch
Tags:cab nVpn RAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: SD84.btc-net.bg
Sending IP: 212.39.90.84
From: i_koleva@mbox.contact.bg
Subject: төлбөр
Attachment: 11091181717661515151.cab (contains "11091181717661515151.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35eca6e2b3061f51a6676b59e345da69de46302cd7dee364700492831749d539/
Threat name:
Win32.Trojan.Jaik
Create hunting rule
Status:
Malicious
First seen:
2021-01-30 12:58:05 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gxwknyvtaypvdjthnnm6gro2nhpemmbm27pogzdqasjigf2j2u4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35eca6e2b3061f51a6676b59e345da69de46302cd7dee364700492831749d539

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

cab 35eca6e2b3061f51a6676b59e345da69de46302cd7dee364700492831749d539

(this sample)

AveMariaRAT

Executable exe b8fd90ea39eaa1c4f5cd065194403d851eda875f49f1de95d1f506039dc1a7ff

  
Dropping
MD5 c4ec7bbcbf39f2a91c0d0aceecec2c98
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8fd90ea39eaa1c4f5cd065194403d851eda875f49f1de95d1f506039dc1a7ff

Comments