MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3f11a2e780cb4c62a031ef8c12f63a05366e9addae2843abc616ac1bb76f762. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3f11a2e780cb4c62a031ef8c12f63a05366e9addae2843abc616ac1bb76f762
SHA3-384 hash: 1f8601502aede98ba1c155e4e081968c37d6b23d80f719a506fc0e102e8cbbe314e79a80fa37529f0b9f6cd90a303b15
SHA1 hash: 3833c6615845ae04df5eb362bd9a85925f494131
MD5 hash: 4b0a77fda7e4c8036142e00749d38b29
humanhash: kentucky-twelve-winter-cup
File name:INQ-TR-04-21-RFQ.7z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:533'110 bytes
First seen:2021-02-04 17:23:48 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:XGnpMs3SR3+iFNtJ1A2V/W2EjATu5qJ0wDVwBW0NjyLC2r+ZJMAlN:2pHiFB1Aw0f5E0wD8oC26JX
TLSH 26B42347D14318F9BF86A3EE00DEA321291662633ED7F1AA648F950F2E74D2B474059F
Reporter abuse_ch
Tags:7z AveMariaRAT RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mail.sayyess.uno
Sending IP: 5.189.220.214
From: Jason Bourne <admin@sayyess.uno>
Subject: Inquiry
Attachment: INQ-TR-04-21-RFQ.7z (contains "INQ-TR-04-21-RFQ.exe")

AveMariaRAT C2:
yetye.ddns.net:7112 (79.134.225.115)

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Drod7zip-A.32031.10697.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3f11a2e780cb4c62a031ef8c12f63a05366e9addae2843abc616ac1bb76f762/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 17:24:11 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpyrultybs2mmkqdd34mcl3dubjwn2nn3lriiov4mfvmdo3w65ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/b3f11a2e780cb4c62a031ef8c12f63a05366e9addae2843abc616ac1bb76f762

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

7z b3f11a2e780cb4c62a031ef8c12f63a05366e9addae2843abc616ac1bb76f762

(this sample)

AveMariaRAT

Executable exe e6bc16569c26cf95b2b94f00a8f5afaf704bcd6503328ddcbad65de19caf1afc

  
Dropping
MD5 43d2962a329797d9c949c8ab0803a54b
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6bc16569c26cf95b2b94f00a8f5afaf704bcd6503328ddcbad65de19caf1afc

Comments