MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d245583d2a1205beccd524c58b513eff37800a5716e1b1cfca13476f849c98e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d245583d2a1205beccd524c58b513eff37800a5716e1b1cfca13476f849c98e
SHA3-384 hash: 17c228082b1f9906503dfea134fac8d6bda612e8648c8af44991de09d6874a29a099a37e96664ae237eef9677f12ec74
SHA1 hash: fb53b7f377ea6e9de49c68cc8f553fb890fbee1f
MD5 hash: d55331958c7b2fe910978942dedec38f
humanhash: oregon-cup-early-utah
File name:DHLEXPRESS.IMG
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'507'328 bytes
First seen:2021-11-22 09:05:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:OQBs30G4jiT/OoBVSqRIJS+od3xPzeH/JK/bw:Oos4bMSqOJS9SHhk
TLSH T1F3659F426DB2A836C98628787E0B457428F6ED532530A5129FBF980E5FFA9417037DF3
Reporter cocaman
Tags:AveMariaRAT DHL img


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Express <info@dhlband.com>" (likely spoofed)
Received: "from dreamy-germain.185-176-221-94.plesk.page (unknown [185.176.221.94]) "
Date: "Wed, 17 Nov 2021 15:26:03 +0800"
Subject: "DHL On Demand Delivery"
Attachment: "DHLEXPRESS.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.44058.10834.5532.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/619b5d7d94a88037d2fe00a9/reports/eb1107e6-c1f5-4944-9edb-ec55e3bee01d/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d245583d2a1205beccd524c58b513eff37800a5716e1b1cfca13476f849c98e/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-11-17 17:41:17 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lusfla6sueqfx3gnkjgfrnit57zxqaffofxbwhh4ue2hn6cjzgha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ave Maria
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d245583d2a1205beccd524c58b513eff37800a5716e1b1cfca13476f849c98e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

img 5d245583d2a1205beccd524c58b513eff37800a5716e1b1cfca13476f849c98e

(this sample)

AveMariaRAT

Executable exe 2090f5fcafd8bc1938e4ddd869d911e1a89ac529ba984d914cc2f98fadcbc658

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2090f5fcafd8bc1938e4ddd869d911e1a89ac529ba984d914cc2f98fadcbc658
  
Dropping
AveMariaRAT

Comments