MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e42ae4d80ecfacb3266c824c552f28249d981365b8b71f5202b7b63b2573d30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e42ae4d80ecfacb3266c824c552f28249d981365b8b71f5202b7b63b2573d30
SHA3-384 hash: 4ac06f8f0d38291179e54bb845c5ea5d41eca8c45ad2f4c8ff52845d7971b4bc53a5d833cf5c87de6724a5169bba65de
SHA1 hash: d3b39c7de66d6be5ce8d999dd6c648abe5ffe4e7
MD5 hash: 30d73d5d98714ebf897addc71f70d68a
humanhash: king-hotel-kitten-xray
File name:RFQ SAMPLE DESIGNS - IMAGES SPECIFICATIONS -RFQ DTD 271020PDF .z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:421'125 bytes
First seen:2020-10-27 16:39:57 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:mEBRt/JwxLq4teLeTogqo/aMWGEVL+XspRE:mKZOLfteNgvHmVq8s
TLSH 389433AE808F8124CB1FEFF16B50140ADD7E0ECE35BBE56911AE638D58439BE5E0E550
Reporter abuse_ch
Tags:AveMariaRAT RAT z


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: medpex.com
Sending IP: 210.244.73.74
From: Emily & Sales <8150110@naver.com>
Subject: Product Inquiry From Apex Global, South Africa-
Attachment: RFQ SAMPLE DESIGNS - IMAGES SPECIFICATIONS - RFQ DTD 271020PDF .z (contains "RFQ SAMPLE DESIGNS - IMAGES & SPECIFICATIONS - RFQ DTD 271020PDF .exe")

AveMariaRAT C2:
185.222.57.88:5200

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Archive.Malware.Agent-9784587-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e42ae4d80ecfacb3266c824c552f28249d981365b8b71f5202b7b63b2573d30/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 15:24:41 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzbk4tma5t5mwmtgzasmkuxsqje5tajwlofxd5jafn5whmsxhuya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e42ae4d80ecfacb3266c824c552f28249d981365b8b71f5202b7b63b2573d30

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

z 8e42ae4d80ecfacb3266c824c552f28249d981365b8b71f5202b7b63b2573d30

(this sample)

AveMariaRAT

Executable exe ada66354b35f631d05fb44b963df23fb63a6363509ad4760d4ac49d8b726c6f9

  
Dropping
MD5 3c81e70ded5657f3937075092c016324
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ada66354b35f631d05fb44b963df23fb63a6363509ad4760d4ac49d8b726c6f9

Comments