MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b3298f4645b7176960fd26104ce5f10bdfd0dcea1a608d8298e90ec007eb923. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b3298f4645b7176960fd26104ce5f10bdfd0dcea1a608d8298e90ec007eb923
SHA3-384 hash: 0126b6054201d846ec9a63bbc4412443863b23407a9bb2011631268eaa56a885a814df45a9db8ed1a646cee9213572e3
SHA1 hash: eaa8b3dc73d3e5fb193257118194edd5d44b0248
MD5 hash: 8fe4d691800941c638fd3f1dcdb6a10d
humanhash: eleven-pip-glucose-enemy
File name:CI_PL.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:424'856 bytes
First seen:2020-07-18 07:46:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:VpI3PBAmrVGq7AwJgMX64uv5NJH2iSw14oFamu4u3tj01B1Tno3dXf7xY0YWAT8:VpISmrVl0wC4a5NJzjFruJ3F53RtYWAQ
TLSH 1294232A4EA5D9CEB34E2EB6CBA32957B44D39E02F13FB0185CD4E525B04F15A9D0C74
Reporter abuse_ch
Tags:AveMariaRAT HostGator rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: gateway33.websitewelcome.com
Sending IP: 192.185.145.221
From: asistencia@promalab.ec
Subject: Re: CI & PL for new order
Attachment: CI_PL.rar (contains "CI_PL.exe")

AveMariaRAT C2:
graceland.ddns.net (46.38.151.248)

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b3298f4645b7176960fd26104ce5f10bdfd0dcea1a608d8298e90ec007eb923/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lmzjr5delnyxnfqp2jqqjts7cc672doougtarwbjr2ioyad6xerq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b3298f4645b7176960fd26104ce5f10bdfd0dcea1a608d8298e90ec007eb923

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 5b3298f4645b7176960fd26104ce5f10bdfd0dcea1a608d8298e90ec007eb923

(this sample)

AveMariaRAT

Executable exe 220d9dee8512451f79c4ea016e9ed065ca3f378f3f1b29531cee3c686a100cce

  
Dropping
MD5 3e9ad736204d17eb3df39faf37ffe849
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 220d9dee8512451f79c4ea016e9ed065ca3f378f3f1b29531cee3c686a100cce

Comments