MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63bf325ba69681027e3ecfe828b993abe799ed0bc43c15617668abbdaa9db55b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63bf325ba69681027e3ecfe828b993abe799ed0bc43c15617668abbdaa9db55b
SHA3-384 hash: 918ec33d62f5c8eeb1f0b1833ba13d7cc539b5640961848e6742d83a203948f1137cc0b3efc43191e17378343cd8a137
SHA1 hash: 02f8b8b8ad01f65ac9af419de5956faa7843da5e
MD5 hash: 5d707a4553f073324b1b849b3f891e89
humanhash: apart-solar-berlin-speaker
File name:Arifashayan_2020_06_04_RFQ.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:616'162 bytes
First seen:2021-04-07 05:56:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:rD9vFm61tXeb2A80vfZpIYPRoMoGjEgrT2Vwskc3ehhnu3sTw18a:dtm6LA803HJCGYATa3sTw7
TLSH ABD423FF5DD4C9A31008B4304B087CBAA74EA62A16BAC3DC511EEF7E6161DDA507486B
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns1.dropboxer-asia.pw
Sending IP: 104.168.200.175
From: Antonella Lattarulo <jrt@dropboxer-asia.pw>
Subject: Arifashayan 2020 06_04_RFQ
Attachment: Arifashayan_2020_06_04_RFQ.rar (contains "Arifashayan_2020_06_04_RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.16436.15356.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63bf325ba69681027e3ecfe828b993abe799ed0bc43c15617668abbdaa9db55b/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 05:57:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mo7tew5gs2aqe7r6z7ucromtvptzt3ilyq6bkylwncv33ku5wvnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63bf325ba69681027e3ecfe828b993abe799ed0bc43c15617668abbdaa9db55b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 63bf325ba69681027e3ecfe828b993abe799ed0bc43c15617668abbdaa9db55b

(this sample)

AveMariaRAT

Executable exe 757d6be9f53d159e382e9b82a4baa567d4a8173b30ccd788234f4afb5db16eba

  
Dropping
MD5 3bdd9fe778002e20e2db0830a6199bb7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 757d6be9f53d159e382e9b82a4baa567d4a8173b30ccd788234f4afb5db16eba

Comments