MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 4 File information Comments

SHA256 hash:	6f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda
SHA3-384 hash:	e07f7427e17b070142ef4fd943a8b36615c58bc76db59369508ca5df87af6cd69dbd8e5ecffd52ed64e5267c4770b638
SHA1 hash:	e8ec5f8f5aee7943dd10a449ee5551940058b49a
MD5 hash:	fbede08fbf9132b31cbc57436a4e7a8e
humanhash:	missouri-social-hawaii-hotel
File name:	sunwz
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	208'216 bytes
First seen:	2024-06-26 14:10:41 UTC
Last seen:	2024-06-26 14:10:47 UTC
File type:	unknown
MIME type:	text/plain
ssdeep	3072:8jLSoQt+ggVicyoKtFSRoAbSirqVE8kKM+138CcC4Jgcxb0drP/zo402Z2DYi64O:8ihFCizcanimlM+138CcC47xqToLcB7
TLSH	T167149FFB63916D9F4C1C0BA1F520434A5C189DCFE1ECC2F17A93A4BD468A454A6A4EFC
Reporter	JAMESWT_WT
Tags:	0bj3ctivity

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.HEUR.Trojan.Win32.Agentb.gen.21246.17275.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/667c217feae3878d8f3b7dd4/reports/066931d0-4602-4731-b466-8b87ca546430/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda

Result

Verdict:

MALICIOUS

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n4mugh5in73jl7qghww3ivq7lhnmlxabcqzme7ish5brj2f3vtna._file

Verdict:

unknown

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	ClamAV_Emotet_String_Aggregate Create hunting rule

Rule name:	SUSP_Reversed_Base64_Encoded_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an base64 encoded executable with reversed characters
Reference:	Internal Research

Rule name:	SUSP_Reversed_Base64_Encoded_EXE_RID3291 Create hunting rule
Author:	Florian Roth
Description:	Detects an base64 encoded executable with reversed characters
Reference:	Internal Research