MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64bcb9c87f3e818a09349cbacce624de54bf7668e0d340912a017b5e9a35efe6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64bcb9c87f3e818a09349cbacce624de54bf7668e0d340912a017b5e9a35efe6
SHA3-384 hash: 81335689c29e5ebd4df89d323b6f33900d8c890e0be2460a89344037d073776cb3b824a3333b077a430b6b28e072d832
SHA1 hash: 4bbdada5c8037ee0924e5e59063a54c67e6c95be
MD5 hash: a71d3dabb71f27cc04a540bc810be5e2
humanhash: twenty-snake-blossom-oscar
File name:CARASOL LIMITED GROUP PRESENTATION.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:610'119 bytes
First seen:2021-04-07 05:55:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:z1n5bwc8Lp2Qur55bbKRRtNFIk35Rznrc4M+J3Evgx6DA:zIc8Lp2/5tbKX+e5Rs0J3+gX
TLSH 25D42376D76D4AED2ABA216AABCCC0D8F41439F92206B04794380C9255F6F7FED1342D
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns1.carasollimited.pw
Sending IP: 104.168.202.229
From: jrt@carasollimited.pw
Subject: CARASOL LIMITED GROUP PRESENTATION
Attachment: CARASOL LIMITED GROUP PRESENTATION.rar (contains "POVdRnvBDNdZ0tZ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64bcb9c87f3e818a09349cbacce624de54bf7668e0d340912a017b5e9a35efe6/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 04:18:42 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ms6ltsd7h2ayucjuts5mzzre3zkl65ti4djubejkaf5v5grv57ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/64bcb9c87f3e818a09349cbacce624de54bf7668e0d340912a017b5e9a35efe6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 64bcb9c87f3e818a09349cbacce624de54bf7668e0d340912a017b5e9a35efe6

(this sample)

AveMariaRAT

Executable exe d266e212f266cc2c64e151d3543e34beaed2a3666fa215c2a88d8a042b6e9a4a

  
Dropping
MD5 9710a8a9857b099694317f05c4da703e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d266e212f266cc2c64e151d3543e34beaed2a3666fa215c2a88d8a042b6e9a4a

Comments