MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63a73ca63be695931c9386049211b61913f7c51a3d7ee1c7baa0f139125c37ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63a73ca63be695931c9386049211b61913f7c51a3d7ee1c7baa0f139125c37ce
SHA3-384 hash: 4cf4c050eea04bb90703f49704ea280345f6247a1970da3c9bab8484c3aae78820d30752254d2d824542b99378867ed3
SHA1 hash: e6ce8784cbf852307ecd2ea1e191d756e39f87af
MD5 hash: 6bf9ff0ce9b6a7195d3fac85a356289e
humanhash: maryland-carolina-hot-ink
File name:RFQTRN#100371479500003_QUOTATION_GOODS_SUPPLY_TRINITY.7z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:440'728 bytes
First seen:2022-03-31 06:36:59 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:SSV4CBi6Wv6/qmvIse42ZUgsoFZnHsze+3Of9XQHKa:+76w6iiIz4SdrMzv3YS
TLSH T1DF9423442E8D41765C6825FE0B7DF8A6F58742EB97BECDC8B77D89E88041610538BF0A
Reporter cocaman
Tags:7z AveMariaRAT QUOTATION RFQ


Avatar
cocaman
Malicious email (T1566.001)
From: ""Chi Trinh" <sales.chitrinh@trinityvietnam.vn>" (likely spoofed)
Received: "from jelloworks.com (unknown [67.205.151.38]) "
Date: "Thu, 24 Mar 2022 10:24:05 +0100"
Subject: "REQUEST FOR QUOTATION"
Attachment: "RFQTRN#100371479500003_QUOTATION_GOODS_SUPPLY_TRINITY.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe fareit formbook keylogger packed
Link:
https://www.filescan.io/uploads/62454c10a19c649412b1389a/reports/8f0aad22-a90a-4b61-b36e-87cbc83a3095/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63a73ca63be695931c9386049211b61913f7c51a3d7ee1c7baa0f139125c37ce/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-24 16:29:10 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
25 of 42 (59.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mottzjr342kzghetqycjeenwdej7pri2hv7odr52udytses4g7ha._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220331-hdggrsbfhp/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.53
Link:
https://yomi.yoroi.company/submissions/63a73ca63be695931c9386049211b61913f7c51a3d7ee1c7baa0f139125c37ce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

7z 63a73ca63be695931c9386049211b61913f7c51a3d7ee1c7baa0f139125c37ce

(this sample)

AveMariaRAT

Executable exe e11e9572f2bc772cb5858c427326c4408520d1eb0f62ed2c9069c3c3dc710a01

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e11e9572f2bc772cb5858c427326c4408520d1eb0f62ed2c9069c3c3dc710a01
  
Dropping
AveMariaRAT

Comments