MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b52ddc71a99712e6158625d19f11001cf29ec4cd05df9b8112fb6fdbc2a1bc71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b52ddc71a99712e6158625d19f11001cf29ec4cd05df9b8112fb6fdbc2a1bc71
SHA3-384 hash: cbebb87f5f95f5e02c28cc769bd4cb1557b64e9ab48ba7f086c4f6dab2bcb58d20aad1734123d5a22cb13f25f7a1fe52
SHA1 hash: 48eec114af47f7536ba91ce01e85a921d695b2fe
MD5 hash: 5809e2049713bda86766fb5d07763f10
humanhash: zulu-william-orange-whiskey
File name:RFQ8086A_461A_0000086_300_3550_2021.img
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'572'864 bytes
First seen:2021-04-04 16:50:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:p3Z1rQt44xwsSJ2LF8IIlhFDld2WGFlKqJU1SiPWm4UjvF:Vr642wsMc83JRd2WGD1XiL4Ujd
TLSH D575A376BB5A8E32F08BA03CE58AF5744463B91135C950622EDCFB05DB67B403AF1876
Reporter abuse_ch
Tags:AveMariaRAT img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.econt.com
Sending IP: 213.91.197.11
From: Nesma Trading Co. Ltd <tenders@sanmed.in>
Subject: Nesma Trading Co. Ltd- Purchase Order #8086A-46
Attachment: RFQ8086A_461A_0000086_300_3550_2021.img (contains "RFQ#8086A_461A_0000086_300_3550_2021.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1133.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
SUSPICIOUS
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-04 07:06:32 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wuw5y4njs4jomfmgexiz6eiadtzj5rgnaxpzxais7nx5xqvbxryq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

img b52ddc71a99712e6158625d19f11001cf29ec4cd05df9b8112fb6fdbc2a1bc71

(this sample)

AveMariaRAT

Executable exe 1ec80487df001c0f6d41a90bbe2451242977a6f36a276d6eefa8aef0f593ab6b

  
Dropping
MD5 da76723b187edc1913d3151d6ba0dd78
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ec80487df001c0f6d41a90bbe2451242977a6f36a276d6eefa8aef0f593ab6b

Comments