MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51c71668c903f484b1eeddfc0ccb75aee95c22a84a1d06816f4297a1154212c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51c71668c903f484b1eeddfc0ccb75aee95c22a84a1d06816f4297a1154212c9
SHA3-384 hash: 53749a3b898b820d2d03ebf7a78bb9ffba780eefe0fb161a5f031d49f06cc8380d88bdaa304f42c56053f3a63bd44b39
SHA1 hash: 8e2b019a0a3c242816623f2834754d2df060dcb0
MD5 hash: 23a181663c603d71e8f7a8f028df373d
humanhash: gee-illinois-violet-nebraska
File name:SAMPLE IMAGES AND SPECIFICATIONS - RFQ DTD18-08-20PDF.z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:389'533 bytes
First seen:2020-08-18 19:18:40 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:jyIhGKfiHgQOoZtDToQ1qbQhPR3hx/dAPniMo8/uWsSK5/x6uFGPTQdO7rGmJoqv:jyIh1aHvPtDToQiq9hxOPzuWsj5/x+hB
TLSH FF842302E4B748DB76A4394E61C6A043F413153C07CA0EEDF605BD662D39E1F5AEAD6C
Reporter abuse_ch
Tags:AveMariaRAT RAT z


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

From: Aisha <goldleine@naver.com>
Subject: Product Inquiry - Anuga Fair Contact
Attachment: SAMPLE IMAGES AND SPECIFICATIONS - RFQ DTD 18-08-20PDF.z (contains "SAMPLE IMAGES AND SPECIFICATIONS - RFQ DTD 18-0820PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51c71668c903f484b1eeddfc0ccb75aee95c22a84a1d06816f4297a1154212c9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:20:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=khdrm2gjap2ijmpo3x6azs3vv3uvyivijioqnalpikl2cfkccleq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/51c71668c903f484b1eeddfc0ccb75aee95c22a84a1d06816f4297a1154212c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

z 51c71668c903f484b1eeddfc0ccb75aee95c22a84a1d06816f4297a1154212c9

(this sample)

AveMariaRAT

Executable exe 3b9f853d85ab9ac1d0999e04c1b6dca90ccba2a912b9ba95666b53ef71eeb177

  
Dropping
MD5 f783f64801814a7e9406900cdcf747fd
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b9f853d85ab9ac1d0999e04c1b6dca90ccba2a912b9ba95666b53ef71eeb177

Comments