MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 749b921222ab091e8bb989877abfaa35ca3d2507d08bdbe35990b09637411569. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 749b921222ab091e8bb989877abfaa35ca3d2507d08bdbe35990b09637411569
SHA3-384 hash: 0ade0273ac38039604942b86134a3ce085af05d3026c4508fb69f6cb0d28e09dc100913bf94a4383a25eee723acf7f76
SHA1 hash: 85c824faf4b054a6489d833cee37eba4a50cd7ca
MD5 hash: 2767c1338db99c134dddf90afb45dd6a
humanhash: washington-iowa-queen-uncle
File name:proforma invoice.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:522'632 bytes
First seen:2020-05-28 05:26:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:HNrPwxJVSNHkkv2nGUypcCvTKGkEBtvCzTR0tIz0FR/Af/n3s:HBw94Ekv2GUyphvTKZs6zTRcIz0FqH3s
TLSH 9EB42371FFA66E24D0D64148FEC7A5D362632AC04042CA5B364A241B4BF2FB9DAC5C7D
Reporter abuse_ch
Tags:AveMariaRAT RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: standfordgroups.com
Sending IP: 62.173.142.172
From: Anne Shui <zhkj@vip.163.com>
Subject: PAYMENT REJECTED
Attachment: proforma invoice.zip (contains "proforma invoice.exe")

AveMariaRAT C2:
79.134.225.34:5200

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23890.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 05:36:31 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 749b921222ab091e8bb989877abfaa35ca3d2507d08bdbe35990b09637411569

(this sample)

AveMariaRAT

Executable exe 4d9a3ce8ea01677b182e55858ff0373a94ae4dcd30e777aa9e5e71d61e40db37

  
Dropping
MD5 d87548293c755cc85405cb4c16f4c526
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4d9a3ce8ea01677b182e55858ff0373a94ae4dcd30e777aa9e5e71d61e40db37

Comments