MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 603c9e1506e6e044917519f8a3be1d5f0f2a438968ba80f6caf511fc7072ad25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 603c9e1506e6e044917519f8a3be1d5f0f2a438968ba80f6caf511fc7072ad25
SHA3-384 hash: a05070a51d65b809912f8503ab666b58378ed60b92887e972d08c70b53ffe4bd08fb1ffbe4a5e96374987c4d6fa1eb59
SHA1 hash: fd23b80d1526221475224a1198193cabf250d15e
MD5 hash: d1e8c718fa49b7926fe362b018ee9033
humanhash: moon-harry-football-hamper
File name:PP-9822.iso
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:196'608 bytes
First seen:2020-10-27 16:45:17 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:fsYsYsYiGaV89FXvgsYsYsYicsYsYsYihPIsYsYsYiEsYsYsYirsYsYsYiG5Zssd:D9tl6w0NCUHXJV44Jre1YV
TLSH 6F14BD4A300BB833EBDA02F0044FDE50F3B5D2BD4961D539A9E91E5CCB6A5563C1B6CA
Reporter abuse_ch
Tags:AveMariaRAT geo iso POL


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: h22.megalink.com
Sending IP: 200.75.160.22
From: Poczta Polska <liamchua@poczta-polska.pl>
Subject: Twoja przesyłka od pana Kowalskiego dotarła
Attachment: PP-9822.iso (contains "PP-9822.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.2e570f632f1fb4a5.15208.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/603c9e1506e6e044917519f8a3be1d5f0f2a438968ba80f6caf511fc7072ad25/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 14:45:53 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ma6j4fig43qejelvdh4khpq5l4hsuq4jnc5ib5wk6ui7y4dsvusq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/603c9e1506e6e044917519f8a3be1d5f0f2a438968ba80f6caf511fc7072ad25

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

iso 603c9e1506e6e044917519f8a3be1d5f0f2a438968ba80f6caf511fc7072ad25

(this sample)

AveMariaRAT

Executable exe 7406e77d7cbbc5344697900906c5a5930330dcdfba382b22181b41494ace670e

  
Dropping
MD5 2e570f632f1fb4a5a018df104caa1692
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7406e77d7cbbc5344697900906c5a5930330dcdfba382b22181b41494ace670e

Comments