MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a452897817432915a91493e1f6a25347abcc2ad75e73dbd80acd5a60a4a2112. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a452897817432915a91493e1f6a25347abcc2ad75e73dbd80acd5a60a4a2112
SHA3-384 hash: aea952af1d03572147625e34bd4b0fd8a5498f8d74f0ef0d8a31ffe5cb6c7ac5aea932ed746e32ae51882a2cfda0858f
SHA1 hash: f108d4b85aed35fc50a13cb196fc1a74fb739798
MD5 hash: a1a9b9de99bedbfd7bb3dbf19ac33820
humanhash: undress-table-robin-connecticut
File name:SF-0419.iso
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:204'800 bytes
First seen:2020-10-06 05:58:13 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:6NyQd1An54jVGozzIXGRqfR6Bo15APzAQzZVe0AJUUf:SyoYR6Bo3PMv2
TLSH B8145F37BE7C475CD2AA86317CF5423121A3AF9797624998B3CDFD1F4AB612C9110AC2
Reporter abuse_ch
Tags:AveMariaRAT CHN geo iso


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: server.pous.us
Sending IP: 5.206.227.71
From: SF Express <milwaukieor@snapfitness.com>
Reply-To: milwaukieor@snapfitness.com
Subject: 待处理的包裹通知
Attachment: SF-0419.iso (contains "SF-0419.exe")

AveMariaRAT C2:
wzefi.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a452897817432915a91493e1f6a25347abcc2ad75e73dbd80acd5a60a4a2112/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 01:17:16 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jjcsrf4boqzjcwurje7b62rfgr5lzqvnoxtt3pmavtk2mcskeeja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4a452897817432915a91493e1f6a25347abcc2ad75e73dbd80acd5a60a4a2112

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

iso 4a452897817432915a91493e1f6a25347abcc2ad75e73dbd80acd5a60a4a2112

(this sample)

AveMariaRAT

Executable exe e9ef69bd0b38ec9381f02d44dd893c75ac6c1e6a96f4e320416636860d05d398

  
Dropping
MD5 0c6f8c687cfa49f3cb5880249c2e48f4
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9ef69bd0b38ec9381f02d44dd893c75ac6c1e6a96f4e320416636860d05d398

Comments