MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cd417da68471226ae74dfdcb89a506d591b50561be9f596f894178adc0d366e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cd417da68471226ae74dfdcb89a506d591b50561be9f596f894178adc0d366e
SHA3-384 hash: 0e679af69b3bd95dd735c65a1d8addeb16c7777b8b4e790840e5382abccfe43e7bb58164455651441ba5b40f07190b76
SHA1 hash: db5227839f3eacff1209b2cafff3a99e3f7af01a
MD5 hash: 51c45fd730a27394da19cfe296e6cb3b
humanhash: north-single-stream-leopard
File name:New supplier Inquiry and PO 208202750_ DOC.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:366'331 bytes
First seen:2020-08-27 05:25:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:HXbe3Quu0yZIM+LB7oXSGXMKits3eYQs390sINnx7O+HXy7no6Wj+Scu:HXbe3Quu0yXpnMT4B6S+HC7Ij7Z
TLSH 597423F796005A9936A0D6D4855ACFFE25A6FAE473033847F983876C36B07BCA741183
Reporter abuse_ch
Tags:AveMariaRAT RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp.aonbd.net
Sending IP: 117.58.240.41
From: Purchase Vertex Safety A.S <purchase.vertexsafety.com@protonmail.com>
Reply-To: Purchase Vertex Safety A.S <purchase.vertexsafety.com@protonmail.com>
Subject: Re: New Supplier Inquiry Vertex Instanbul Safety/Equipment/PO208202.
Attachment: New supplier Inquiry and PO 208202750_ DOC.zip (contains "New supplier Inquiry and PO 208202750_ DOC.exe")

AveMairaRAT C2:
divy.nerdpol.ovh:5200 (51.91.36.150)

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodZp-A.10470.8819.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cd417da68471226ae74dfdcb89a506d591b50561be9f596f894178adc0d366e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:27:05 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttkbpwtii4jcnltu37olrgsqnvmrwucwdpu7lfxysqlyvxangzxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/9cd417da68471226ae74dfdcb89a506d591b50561be9f596f894178adc0d366e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 9cd417da68471226ae74dfdcb89a506d591b50561be9f596f894178adc0d366e

(this sample)

AveMariaRAT

Executable exe 25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e

  
Dropping
MD5 c8cc1aa9f0824c83a98cf9072d0079cb
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e

Comments