MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8e681f95ded2c07aba03150d767bae86662e9ae9d2d6e4e2521229404bdaad9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8e681f95ded2c07aba03150d767bae86662e9ae9d2d6e4e2521229404bdaad9
SHA3-384 hash: 02238ec6759f3ed815aa31c0d27ca1b9b6033adfbf7d07d4971338196d3dae81755a6a9651a45f9ed195f240e815bcc7
SHA1 hash: 65999ceab8970aea2cc4eadf31eeac293f22d1c1
MD5 hash: acd38a2ac2600de00b53ba6a67ae5a29
humanhash: pasta-mexico-stairway-leopard
File name:Quotation-245453535.img
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'310'720 bytes
First seen:2021-12-23 12:54:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:NHr/WK67KvY2K/1jir4VyyJ8Wg7T1DSiTsDiSUMPVg5EcCKk:hWV7KG1jiMGP7p2lVPVEEcI
TLSH T13C55BD5763246152C0B5CE306115DA04CE18BD41F295AF9A7EDC3E9FBBE36822B42F0E
Reporter cocaman
Tags:AveMariaRAT img


Avatar
cocaman
Malicious email (T1566.001)
From: "info@shark-factory.com.tw" (likely spoofed)
Received: "from shark-factory.com.tw (unknown [212.192.241.222]) "
Date: "23 Dec 2021 01:25:30 -0800"
Subject: "Quotation-245453535"
Attachment: "Quotation-245453535.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
83%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61c471ab8991ba72b393ac14/reports/35890979-1ef3-4011-af2f-683344591693/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8e681f95ded2c07aba03150d767bae86662e9ae9d2d6e4e2521229404bdaad9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-23 12:55:10 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdtid6k55uwapk5agfinoz525btgf2notuww4trfeerjibf5vlmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8e681f95ded2c07aba03150d767bae86662e9ae9d2d6e4e2521229404bdaad9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

img a8e681f95ded2c07aba03150d767bae86662e9ae9d2d6e4e2521229404bdaad9

(this sample)

AveMariaRAT

Executable exe 04740939cabdb6b6e742cc74d669672eadea15b28f49ecbe598c9400bc830628

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 04740939cabdb6b6e742cc74d669672eadea15b28f49ecbe598c9400bc830628

Comments