MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 713b6948a968c58c91ddb22acd83a0061885a738299cf073a906aa82f800005c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 713b6948a968c58c91ddb22acd83a0061885a738299cf073a906aa82f800005c
SHA3-384 hash: 0ecd9978f2b3dd9d81655143da7e90f8d5cfe5fc442edfa8b1a0181c75bb6fb5fd6c516cf5d3d9fa507dc8027e3ffb83
SHA1 hash: 4e0f05049fec3e5bed5b318c154f61dbc07edc5a
MD5 hash: fec0a522d796813272982cf2d40771fa
humanhash: twenty-eighteen-don-cat
File name:CI_PL.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:414'392 bytes
First seen:2020-07-20 09:18:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:SFESjp07/rD59/ycD8/3AWq+n6B4erBtC0dHby:SyxLrfPD8/hX6dBtn+
TLSH 11942378F628700B641E279BB091DBAF0F52F78B089C94765B8F07A0D79624C757BA34
Reporter abuse_ch
Tags:AveMariaRAT rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: galapagos2.ecuahosting.net
Sending IP: 116.202.133.113
From: dlopez@emdecor.com
Subject: Re: CI & PL for new order
Attachment: CI_PL.rar (contains "CI_PL.exe")

AveMariaRAT C2:
graceland.ddns.net:3720 (46.38.151.248)

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/713b6948a968c58c91ddb22acd83a0061885a738299cf073a906aa82f800005c/
Threat name:
Win32.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:20:07 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oe5wssfjndcyzeo5wivm3a5aaymiljzyfgopa45ja2vif6aaaboa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/713b6948a968c58c91ddb22acd83a0061885a738299cf073a906aa82f800005c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 713b6948a968c58c91ddb22acd83a0061885a738299cf073a906aa82f800005c

(this sample)

AveMariaRAT

Executable exe eef2dcb1fafac42f5c48375e7af29462a635b514521df5bd3b45515827517a6a

  
Dropping
MD5 c90d015585810fc50edf7bebcdf47e0e
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eef2dcb1fafac42f5c48375e7af29462a635b514521df5bd3b45515827517a6a

Comments