MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36b5e133209a62065df1ea5aaff203767c224e8ead62f303c5391ff74c72d96a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36b5e133209a62065df1ea5aaff203767c224e8ead62f303c5391ff74c72d96a
SHA3-384 hash: 6da36877722b04be93635d57b99060136998b2f9538b3264409816ab13fa0722f02468a154920fb903e09fcce973c1ef
SHA1 hash: bdcebb098a9600b299d087a40531fbfaa2ce88e7
MD5 hash: 8afe03c5927a3486a64137151fede787
humanhash: mobile-don-october-network
File name:IMG04_26TH-OCT-20.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:270'084 bytes
First seen:2020-10-26 12:55:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:LAqjF5OXKXw5GJUNhRFQCKd+9Jf0COki5pc8a9zOSZsGvwbZ:L9TOXMwsQPHlxi5GbOSBvwbZ
TLSH 034423C3967A443B4961D9597AD00778E4ECE2030B6E8F4B7C7274F2389FC6A9F28509
Reporter abuse_ch
Tags:AveMariaRAT rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: node19016-cpanel-mudra.india1.cloudhubble.in
Sending IP: 45.252.190.17
From: Anita Verma <anitavm716@gmail.com>
Subject: SMS CREDIT TOP UP
Attachment: IMG04_26TH-OCT-20.rar (contains "IMG04_26TH-OCT-20.SCR")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36b5e133209a62065df1ea5aaff203767c224e8ead62f303c5391ff74c72d96a/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 01:19:18 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g226cmzatjramxpr5jnk74qdoz6cetuovvrpga6fhep7otds3fva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 36b5e133209a62065df1ea5aaff203767c224e8ead62f303c5391ff74c72d96a

(this sample)

AveMariaRAT

Executable exe 172b1a1059dc82e60b4a5b43985faa450af3a16d2ae21d6476fab1f6a18cb553

  
Dropping
MD5 c0ab1079292c0a793a6f8459efeef1d0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 172b1a1059dc82e60b4a5b43985faa450af3a16d2ae21d6476fab1f6a18cb553

Comments