MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c6bc4dcd62f6647b85eadf13d0f581fae657cbc4c5053463666d9f5a5a7841e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c6bc4dcd62f6647b85eadf13d0f581fae657cbc4c5053463666d9f5a5a7841e
SHA3-384 hash: 801ce9f101ec780cb78630d6e7aa892f20482322a39e7bf728685da991d2a1f68f37b856d61946bf98d02f0c05eea386
SHA1 hash: 383a2b88dfd07606e65f68575102e60c2ac3233b
MD5 hash: fc1947a1430eddf62a9de60ccb828a26
humanhash: nebraska-south-alanine-two
File name:Scanned Copy Proforma Invoice.r28
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:40'145 bytes
First seen:2020-12-10 07:00:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:GZw3poeR3JTVZ0oVOqpYwOa1tlmBoFxJB3BOsrGx8z2d302i291dK2Uwu:1BXyoVOqIarlTxBjrLz2DZKP
TLSH E403F28A334FC47B39AFB599D8CB98179869DEF92AD165F7521602207B203CD410B8D2
Reporter cocaman
Tags:AveMariaRAT GuLoader r28


Avatar
cocaman
Malicious email (T1566.001)
From: ""Open Payment" <info@daimler.com>" (likely spoofed)
Received: "from slot0.mouldedfibertech.com (slot0.mouldedfibertech.com [45.85.90.92]) "
Date: "Wed, 09 Dec 2020 17:40:15 +0000"
Subject: "Re: Urgent Proforma Invoice Payment"
Attachment: "Scanned Copy Proforma Invoice.r28"

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c6bc4dcd62f6647b85eadf13d0f581fae657cbc4c5053463666d9f5a5a7841e/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-12-10 04:35:01 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
15 of 27 (55.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hrv4jxgwf5tepoc6vxyt2d2yd6xgk7f4jrifgrrwm3m7ljnhqqpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3c6bc4dcd62f6647b85eadf13d0f581fae657cbc4c5053463666d9f5a5a7841e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 3c6bc4dcd62f6647b85eadf13d0f581fae657cbc4c5053463666d9f5a5a7841e

(this sample)

GuLoader

Executable exe 619379c10c3c49152dae38504ebc779e3e6232e33ff7f8b9f23c2695a6d92fcb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 619379c10c3c49152dae38504ebc779e3e6232e33ff7f8b9f23c2695a6d92fcb
  
Dropping
GuLoader
  
Dropping
SHA256 56b95c3399a705e1bcdc312f3c82749308279f744f1199a59e9bcb3818c194c9
  
Dropping
AveMariaRAT

Comments