MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6337d1b6cd5ac21f8600e025b2225714127c20a307d03778fde6572dda65618c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6337d1b6cd5ac21f8600e025b2225714127c20a307d03778fde6572dda65618c
SHA3-384 hash: d4e52194592b9d83924b73d7d47c3f6b997b319be37cb8180a1724687c5473cf3b8ec5c977bf8f86c18211db23020e4c
SHA1 hash: 9ab55c9acb0708f042ea730fecaad65dc9e50acd
MD5 hash: 0a881619869b0613b14e89196eeb29a9
humanhash: lima-mockingbird-lake-diet
File name:sample order.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:481'149 bytes
First seen:2020-10-11 07:58:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ApHPi6wAMWBlG1QDRjQypfynghlEkJuOzf/XUKkVpf:ANi6wAMWBlG1KR5pWghTJu5zf
TLSH 71A4236492E851AC7E0DBB2E562B69F99105B0E4471FDD9C9C804B2EEDC49108FCFB8D
Reporter abuse_ch
Tags:AveMariaRAT Endurance RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: gproxy2-pub.mail.unifiedlayer.com
Sending IP: 69.89.18.3
From: kfl2.purchase@kemsltd.com
Reply-To: CynthiaChcn0801@outlook.com
Subject: sample order
Attachment: sample order.zip (contains "exiUqZuqaXhdn5R.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6337d1b6cd5ac21f8600e025b2225714127c20a307d03778fde6572dda65618c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-10 18:21:36 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mm35dnwnllbb7bqa4as3eisxcqjhyifda7ido6h54zls3wtfmgga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6337d1b6cd5ac21f8600e025b2225714127c20a307d03778fde6572dda65618c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 6337d1b6cd5ac21f8600e025b2225714127c20a307d03778fde6572dda65618c

(this sample)

AveMariaRAT

Executable exe ffa217c445af7f07f0c9fbdcc488db8e06ecfdb43906c6c5e7a11f7ac04b4bf4

  
Dropping
MD5 b68bc90f22c93e7d6d2f9df4a8300d73
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ffa217c445af7f07f0c9fbdcc488db8e06ecfdb43906c6c5e7a11f7ac04b4bf4

Comments