MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8540440ce7cefc930adf4ad0df0e8d04c4d5bd326100fd791fe0dca3a369c9ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8540440ce7cefc930adf4ad0df0e8d04c4d5bd326100fd791fe0dca3a369c9ae
SHA3-384 hash: 175a55437b7ff67dbb81d4e11d2413c5d604ccff25d012302f480ac350a12ad4956544f8f723ff44f175cd41e505592f
SHA1 hash: 04cc1161e8e0623eb4825cffc2a0da9d96d51dc0
MD5 hash: fa6d946c2ffb7471793c9476f573b3e5
humanhash: snake-blossom-lithium-crazy
File name:Purchasing Order.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:282'131 bytes
First seen:2020-11-19 08:54:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:eUj8v08ieM31PEKVbS69eymUkFFQgqmImYj90T0ljGne22aNzj:eA8sBl3/c69eymUkfQS29I0ljGne2Xzj
TLSH 2F5423E3FF7941AB8F2A78639A4316533A488040513EB2C8D473E38949D31F2186E77E
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: s237797.cloud.flynet.pro
Sending IP: 193.47.34.9
From: Anna Williams<tracy01@never.com>
Subject: Purchasing Order
Attachment: Purchasing Order.zip (contains "Purchasing Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21503.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8540440ce7cefc930adf4ad0df0e8d04c4d5bd326100fd791fe0dca3a369c9ae/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 08:55:07 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvaeidhhz36jgcw7jlin6dunatcnlpjsmeap26i74dokhi3jzgxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 8540440ce7cefc930adf4ad0df0e8d04c4d5bd326100fd791fe0dca3a369c9ae

(this sample)

AveMariaRAT

Executable exe db6e23f68a99732cb181a9c16d3e39010e10b49a59a7d955658b30b60dd765a4

  
Dropping
MD5 6c7ef684c09ef56bcff4ee283ec23dce
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db6e23f68a99732cb181a9c16d3e39010e10b49a59a7d955658b30b60dd765a4

Comments