MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b4d123f648ed922dda3dabaa0a43d19beefb7cd54812aee0b47ad454be040f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b4d123f648ed922dda3dabaa0a43d19beefb7cd54812aee0b47ad454be040f4
SHA3-384 hash: a6f28d3616387c8bee4d8d0dc4938870109f84c0e6a94b7bdaa771997f57e7a50e963bd6da10ed25eec0568b36c60024
SHA1 hash: f0ba3cf1b0fe5f5306262a887c965df60c75d8c1
MD5 hash: 6eeb04a6c94ab7a769408efedee39404
humanhash: vegan-emma-edward-robin
File name:Descrição da oferta do produto 873564635640rden2020.arj
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:24'678 bytes
First seen:2020-10-14 15:15:21 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:V7/xURjZmthsFHPKpv2JK55TOf30l2aZk/:1/xUbIsFg245TOsu/
TLSH ABB2E1A0B8E36694EE9B3A430CABB84131E4122D677DECDEDD90C053FF345E1288C954
Reporter abuse_ch
Tags:arj AveMariaRAT geo PRT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: s65.100h.pt
Sending IP: 195.200.252.65
From: geral@cm-arruda.pt
Subject: Precio de oferta
Attachment: Descrição da oferta do produto 873564635640rden2020.arj (contains "Descrição da oferta do produto 873564635640rden2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b4d123f648ed922dda3dabaa0a43d19beefb7cd54812aee0b47ad454be040f4/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 09:56:33 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tngrep3er3msfxnd3k5kbjb5dg7o7n6nksasv3qli6wuks7aid2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9b4d123f648ed922dda3dabaa0a43d19beefb7cd54812aee0b47ad454be040f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

arj 9b4d123f648ed922dda3dabaa0a43d19beefb7cd54812aee0b47ad454be040f4

(this sample)

AveMariaRAT

Executable exe b14a843c73a4020a9564492611f8a028ad6437d38e71624ba41f597122933ca4

  
Dropping
MD5 5d85f3bce243ee18cc50c2eb43191b1c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b14a843c73a4020a9564492611f8a028ad6437d38e71624ba41f597122933ca4

Comments