MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b2229e9d24c09daf994e9c8191b9ef1593f6a1fa56decde4ec1a64212153f57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b2229e9d24c09daf994e9c8191b9ef1593f6a1fa56decde4ec1a64212153f57
SHA3-384 hash: b54a31ae40cfa079872175704c25e24ef62362d69951493df226288e837080cd1833ee169c335f7fddd351f67c0be9a5
SHA1 hash: 0e8fe10a2788545e6a010903035e9aad706d9843
MD5 hash: 6535bf731cfbafe64f694d65c0ea8074
humanhash: white-carolina-utah-alpha
File name:Quantum Trading Limited - PRODUCTS LIST.7Z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:308'948 bytes
First seen:2022-02-02 13:43:57 UTC
Last seen:2022-02-02 13:49:18 UTC
File type: 7z
MIME type:application/x-rar
ssdeep 6144:joLP0E9Jn2vKoysxBhLFUJW+CSfVdAWfpcA8WGCH6u0+uFfzunqk1W/c2/5OO:joLP/3n2vpxBhRUJAAoocShH64uFfzuw
TLSH T1B4642336F4E1E38A8D5AC58C7C73774A38A714B61BB3BC3566B16C898D894794CC2B06
Reporter cocaman
Tags:7z AveMariaRAT


Avatar
cocaman
Malicious email (T1566.001)
From: ""Quantum Trading Limited" <phi-hoang@haimy.com>" (likely spoofed)
Received: "from [2.56.56.69] (unknown [2.56.56.69]) "
Date: "2 Feb 2022 01:21:56 -0800"
Subject: "Quantum Trading Limited - PRODUCTS INQUIR"
Attachment: "Quantum Trading Limited - PRODUCTS LIST.7Z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61fa8aa86d25ac9e79fc573f/reports/1f99d7c0-71cf-4e9d-a765-e58fd8cc9640/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b2229e9d24c09daf994e9c8191b9ef1593f6a1fa56decde4ec1a64212153f57/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-02 04:35:36 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lmrct2osjqe5v6mu5hebsg466fmt62q7uvw6zxsoygteeeqvh5lq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/220202-q1tplsabcq/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Checks computer location settings
Sets service image path in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b2229e9d24c09daf994e9c8191b9ef1593f6a1fa56decde4ec1a64212153f57

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

7z 5b2229e9d24c09daf994e9c8191b9ef1593f6a1fa56decde4ec1a64212153f57

(this sample)

AveMariaRAT

Executable exe 96d18a0eb32ccbb67cf566a197c70c546bfc4b36631e0c20dbfd000f94660598

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96d18a0eb32ccbb67cf566a197c70c546bfc4b36631e0c20dbfd000f94660598

Comments