MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 477c82fa08ceb2dce2650cb7e0060d5884da7c230bbb2e05c69968eca288441f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 477c82fa08ceb2dce2650cb7e0060d5884da7c230bbb2e05c69968eca288441f
SHA3-384 hash: e7596d8155d1195fc146f05afcd472f090761855bb5416bf0b0f466232f82ca0b52a023100e7e6b318dd61683d622736
SHA1 hash: 293f4de752af73811c8ce2d5d3a9a832028c47a5
MD5 hash: 4ac2c8a989aa7b9526484760ebed4515
humanhash: venus-mobile-nevada-oxygen
File name:Bank_Swift_EUR32XXXX.7Z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:295'098 bytes
First seen:2020-05-21 09:55:23 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:I3qTNGo0JRAa2BPYp7cZ2kezPg2kb4TUcxpKZLGc0b/Ghc6e3YFjD9:IqTNbwRX2mi+PwoUcx6icwGhc6eWD9
TLSH 9F5423AF92A04A4664D681ABF702C23FA65B3693810FCF1C74904A7DCF504748DBE67B
Reporter abuse_ch
Tags:7z AveMariaRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: llsg976-a17.servidoresdns.net
Sending IP: 82.223.190.14
From: Leon Lopez <soporte@etnvending.com>
Subject: Re Due payment
Attachment: Bank_Swift_EUR32XXXX.7Z (contains "Bank_Swift_EUR32XXXX.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 10:36:54 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
14 of 48 (29.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i56if6qiz2znzytfbs36abqnlccnu7bdbo5s4bogtfuoziuiiqpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

7z 477c82fa08ceb2dce2650cb7e0060d5884da7c230bbb2e05c69968eca288441f

(this sample)

AveMariaRAT

Executable exe 2248af8172666d8874da1df1fc121c29520571361c6aab67e9b156c072531d90

  
Dropping
MD5 032e2f187bfeef42d9805eddcb9deaab
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2248af8172666d8874da1df1fc121c29520571361c6aab67e9b156c072531d90

Comments