MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 858aff03b403d65733ae33366d9f5676eab8660c5b173a9c3529a0c7f8a373d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 858aff03b403d65733ae33366d9f5676eab8660c5b173a9c3529a0c7f8a373d7
SHA3-384 hash: aabb6d819149e13b1cdca3c1675adf1c09ded4be74b7078fddcab5a321a1f223ea7a60f82b50ed5a246c795621b16ccc
SHA1 hash: e0d8aefd2d23c9d1f257f96ebc024f9b38731b9a
MD5 hash: e3a10a7f1b3743c1405e9042e38ddc49
humanhash: sierra-florida-spring-mars
File name:Opis proizvoda prema kvaliteti i modelima2020.arj
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:259'911 bytes
First seen:2020-10-23 13:00:24 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:YrCKWIZtzCKakj0T/tcr2w09nF9HwhhI3rbH5ppEcPY:YmKWqrVouz03pwhhmbH5pG
TLSH E24422C9488BB5F78673009237F88108575C58828F65AF7AF317EB600F0AE5795936ED
Reporter abuse_ch
Tags:arj AveMariaRAT geo HRV RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: h22.megalink.com
Sending IP: 200.75.160.22
From: Goran Zadravec <info@bidakis.com>
Subject: Fwd: Re: Ponuda
Attachment: Opis proizvoda prema kvaliteti i modelima2020.arj (contains "Opis proizvoda prema kvaliteti i modelima2020.exe")

AveMariaRAT C2:
178.170.138.163:4554

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/858aff03b403d65733ae33366d9f5676eab8660c5b173a9c3529a0c7f8a373d7/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 12:10:24 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qwfp6a5uaplfom5ogm3g3h2wo3vlqzqmlmltvhbvfgqmp6fdoplq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/858aff03b403d65733ae33366d9f5676eab8660c5b173a9c3529a0c7f8a373d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

arj 858aff03b403d65733ae33366d9f5676eab8660c5b173a9c3529a0c7f8a373d7

(this sample)

AveMariaRAT

Executable exe 285f4e79ae946ef179e45319caf11bf0c1cdaa376924b83bfbf82ed39361911b

  
Dropping
MD5 874ca6f94620a494593aaa7a0f3c1dc3
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 285f4e79ae946ef179e45319caf11bf0c1cdaa376924b83bfbf82ed39361911b

Comments