MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76204b0857d46e0e9b26b23907064ad62a6e8ab0467fab5fec8c75f8f576ff37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76204b0857d46e0e9b26b23907064ad62a6e8ab0467fab5fec8c75f8f576ff37
SHA3-384 hash: d693b4c463ce29af1dc8db5d2119b9c9fa6bcf0cccb7453f7ef4a95bb92bbff41ede30a47a065d6cee98de5118ffa91c
SHA1 hash: 38c8ce08907fdbb5c79ba0cc41e66a23e9d3a77b
MD5 hash: a3edea57957345b553024abf0cecc9f4
humanhash: winner-papa-princess-oranges
File name:3i7xb.iso
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'507'328 bytes
First seen:2020-12-22 07:26:44 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:8VoBoDVcQagwvUt0Qvx2epCdRwy53fgTVH:8VoBqZaTst0Mx2ey33fgTF
TLSH A565BE0BAB51CE60C8503AB7C695F9E01725EDD71A01A61B621DBE277E331CB7A0E3C5
Reporter abuse_ch
Tags:AveMariaRAT iso nVpn RAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dansmtp1.34503sgz0vpezcx1gncymdgvjc.xx.internal.cloudapp.net
Sending IP: 51.143.32.202
From: Zunair Chouhan<zunair.c@suvidha.com>
Subject: RFQ - New Inquiry
Attachment: 3i7xb.iso (contains "RPG-06708.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76204b0857d46e0e9b26b23907064ad62a6e8ab0467fab5fec8c75f8f576ff37/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 02:16:07 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oyqewccx2rxa5gzgwi4qobsk2yvg5cvqiz72wx7mrr27r5lw743q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76204b0857d46e0e9b26b23907064ad62a6e8ab0467fab5fec8c75f8f576ff37

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

iso 76204b0857d46e0e9b26b23907064ad62a6e8ab0467fab5fec8c75f8f576ff37

(this sample)

AveMariaRAT

Executable exe 424f9c5a1a18e8761ab0e7c549bd7a8d9d5c5824dcb4c812d8f3fa6cd5ed756e

  
Dropping
MD5 c5489dc2d64ae3ec8abcce20e4159eda
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 424f9c5a1a18e8761ab0e7c549bd7a8d9d5c5824dcb4c812d8f3fa6cd5ed756e

Comments