MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9300a25b2fbf67143b9d82689a509766aec5b0e35a001dfa40b8563723254fd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9300a25b2fbf67143b9d82689a509766aec5b0e35a001dfa40b8563723254fd1
SHA3-384 hash: 5e6e2dfed8f77e2d666a260dd86153807e5398a4a0d143e534ca7602b13738cc0f02d34e0ba2675e7a586d8a22ef3d7b
SHA1 hash: dc84912a50cadae2cc84d3a2442c0f141300b447
MD5 hash: f1edb1849942b789580765542421ac17
humanhash: michigan-lemon-maryland-alabama
File name:ES00415Q0123854MDESPN.Gz
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:467'885 bytes
First seen:2020-10-08 14:02:59 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:IOIKeZorER+DmGKwAbM0c+xY1I5JXFct45NSP+vWySMbq/2Txp:I7p8DL04J+oK8mvVnbq/2T/
TLSH E0A423EB03418B29D854A42750DD2AB4F90CCDF24BA3685AF59486DECCF33F5AA4543E
Reporter abuse_ch
Tags:AveMariaRAT gz RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: dts.alphajetservices.com
Sending IP: 185.78.220.36
From: cliente@bbva.com
Subject: BBVA: Instrucción de Depósito a tu Cuenta
Attachment: ES00415Q0123854MDESPN.Gz (contains "ES00415Q0123854MDESPN.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9300a25b2fbf67143b9d82689a509766aec5b0e35a001dfa40b8563723254fd1/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 13:31:41 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=smakewzpx5trio45qjujuuexm2xmlmhdliab36saxbldoizfj7iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9300a25b2fbf67143b9d82689a509766aec5b0e35a001dfa40b8563723254fd1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

gz 9300a25b2fbf67143b9d82689a509766aec5b0e35a001dfa40b8563723254fd1

(this sample)

AveMariaRAT

Executable exe a4cb4b3c28208b5f92691ffa076e7926b70f7c2f03911c5772f3db84f0994807

  
Dropping
MD5 389c4fa866982f6c3d37c2f9af82569f
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4cb4b3c28208b5f92691ffa076e7926b70f7c2f03911c5772f3db84f0994807

Comments