MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d7c6bb8df385cf3068af13ca6f28a1a59149ac00a0ddac7a723ef3813572fdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d7c6bb8df385cf3068af13ca6f28a1a59149ac00a0ddac7a723ef3813572fdc
SHA3-384 hash: 26a63f4c0ef20c6cec4e1127f62068730b5b841394d881a8cec49834763cea98730d54116cbffb2248da9cff279e4b00
SHA1 hash: 9ca42c6a3336cd5040305e1e9f38558c00787a2a
MD5 hash: 8acf6bb131253e44dcb901547f4d1c1a
humanhash: mike-maryland-august-two
File name:Purchase Order -1720.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:542'602 bytes
First seen:2020-12-17 09:06:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:gDL4UNu2983SZ8ZLhu0ACc+iinZsDmQ/ZsesC:gDMUNuYwHnJiAZsDmQaeT
TLSH 57B423CEC23AEE3315616694961F8E020D27769A358A39FF06503D4478EC3EA95E5FE0
Reporter abuse_ch
Tags:AveMariaRAT Endurance rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: gproxy2-pub.mail.unifiedlayer.com
Sending IP: 69.89.18.3
From: purchase <do_not_replay_demo@binaryic.co.in>
Subject: Order List
Attachment: Purchase Order -1720.rar (contains "Purchase Order -1720.exe")

AveMariaRAT C2:
185.219.135.196:5200

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d7c6bb8df385cf3068af13ca6f28a1a59149ac00a0ddac7a723ef3813572fdc/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 09:07:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nv6gxog7hbopgbuk6e6kn4ukdjmrjgwabig5vr5hepxtqe2xf7oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6d7c6bb8df385cf3068af13ca6f28a1a59149ac00a0ddac7a723ef3813572fdc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 6d7c6bb8df385cf3068af13ca6f28a1a59149ac00a0ddac7a723ef3813572fdc

(this sample)

AveMariaRAT

Executable exe 698521474f06c69680b3604a767e213b1863f1a4288be5457e1a435fa665fb04

  
Dropping
MD5 ea2824ef3b0be2e9a63438bfa7d0ae64
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 698521474f06c69680b3604a767e213b1863f1a4288be5457e1a435fa665fb04

Comments