MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94246d6b56c5170edef1747532efc7fed6f7c6acaeeceff1ea25a5d659c49768. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94246d6b56c5170edef1747532efc7fed6f7c6acaeeceff1ea25a5d659c49768
SHA3-384 hash: 2c843b436be326ad270ae5f6ac28b6c9801bb214854061190520142dd57103c52ce4f400c820c3c79268a200add9b491
SHA1 hash: 7ce4a7af65c8a8cc63041cf70554a32b12e2afac
MD5 hash: 793fdc5ed8af37e71e593b4fc59d33ac
humanhash: eighteen-skylark-blossom-thirteen
File name:NEW ORDER #102020.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:558'282 bytes
First seen:2020-10-08 06:38:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xnGdu17BTuWNG6tC8TRjGhkBw7/3OceTO/5szvNXiNxAIGZu:xn2uJBdG6tC8xBOOceT1vNXiNxko
TLSH 12C423A9D2E25019684309F6BC60BF462039BAB573378D19D46D84026BCEFC5ADC53FB
Reporter cocaman
Tags:AveMariaRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Zunzar Vitthalrao Kedar"<zunzar.rurutek@mail.com>"
Received: "from jr-ball.com (tk9-n5z-563-30-r620-8.savacus.net [182.161.78.35]) "
Date: "Wed, 7 Oct 2020 23:33:59 -0700"
Subject: "New order #102020"
Attachment: "NEW ORDER #102020.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94246d6b56c5170edef1747532efc7fed6f7c6acaeeceff1ea25a5d659c49768/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 06:40:07 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sqsg222wyulq5xxror2tf36h73lpprvmv3wo74pkews5mwoes5ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94246d6b56c5170edef1747532efc7fed6f7c6acaeeceff1ea25a5d659c49768

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 94246d6b56c5170edef1747532efc7fed6f7c6acaeeceff1ea25a5d659c49768

(this sample)

AveMariaRAT

Executable exe d0730147283a7764f29031afd0b03018a1f921cbb25f25d4560b126ca31e326b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d0730147283a7764f29031afd0b03018a1f921cbb25f25d4560b126ca31e326b

Comments