MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 604bc6483b72cb13014709bb87a4a85fadb0460d024579199c044d9e7a3c7079. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 604bc6483b72cb13014709bb87a4a85fadb0460d024579199c044d9e7a3c7079
SHA3-384 hash: 35c6056d5bff6396b87c42b66fd68cd3cdb32dcebbf47b330d0f35c7c2ee7c47b1e237284eca0062f5502a82f46964ff
SHA1 hash: 674ba89e505de196d4b2c86f23c52ee95018e3f3
MD5 hash: 5303b626e4e03e29035ae606d21fd4d3
humanhash: don-cardinal-kilo-alpha
File name:INV_9548.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:222'097 bytes
First seen:2020-08-16 13:49:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:qFSY6fuj4k5wWHZApyJx40o3p4fQzOeemmnzlQ+gwq1xs5KxT1sJElrgUwvx:SSTfQPwWHZxJVmCfQytjR39yIo+EFwvx
TLSH E5242305E5FC151C1CFC7CD88DDEF80C27ABB8249320B4A836B9454A46DB66D69C6D5C
Reporter abuse_ch
Tags:AveMariaRAT rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: spfilter-1.mschosting.com
Sending IP: 110.4.40.150
From: Toh Theam Hock & Co (Taiping) <tthco@tohth.com>
Subject: Re: Revised invoice
Attachment: INV_9548.rar (contains "INV_9548.exe")

AveMariaRAT C2:
marchelexa.hopto.org:3720 (46.38.151.248)

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/604bc6483b72cb13014709bb87a4a85fadb0460d024579199c044d9e7a3c7079/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 13:50:07 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mbf4msb3olfrgakhbg5ypjfil6w3arqnajcxsgm4argz46r4ob4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/604bc6483b72cb13014709bb87a4a85fadb0460d024579199c044d9e7a3c7079

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 604bc6483b72cb13014709bb87a4a85fadb0460d024579199c044d9e7a3c7079

(this sample)

AveMariaRAT

Executable exe 4159a61a7c0571bee10a33f8d05ef51de606960476f66a00efcced87680be615

  
Dropping
MD5 7b73397a8f9b8cf29d49b470e2b8ffc0
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4159a61a7c0571bee10a33f8d05ef51de606960476f66a00efcced87680be615

Comments