MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b962d5404f39128a75d92d6c20f21b926301e3f4afa6470258d30a3389739c0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b962d5404f39128a75d92d6c20f21b926301e3f4afa6470258d30a3389739c0f
SHA3-384 hash: e9b836df0b3924582956f3ed4866b0896c6c1f548ea4843ec243038049c1da7945abe00f34f64c1fad6812d6e249eed4
SHA1 hash: 6b6815d0d9255d9f275d0037b85937a71a79e991
MD5 hash: 4787d4bda9bef88024b0f675a9127a03
humanhash: nuts-queen-echo-tennessee
File name:New_Guides-08-2020.img
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-09-01 05:07:00 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:YiZYZWBXFXfMrKm1P3Wj6WrvorDrOXX4Qsq8hPaIj3ax0VrD0Jc:8xb3W+8ynUX4QsqePaIDax0Jm
TLSH F945AF293B56443DED7905B2D468A4D3B7349B583B98C22EB6DE924C4F32BAF7B001C5
Reporter abuse_ch
Tags:AveMariaRAT img RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: server.mtaarch.in
Sending IP: 162.241.107.21
From: Monika Görts <MGorts@mtaarch.com>
Subject: Deco Guide
Attachment: New_Guides-08-2020.img (contains "Guides-08-20.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34452727.18488.24726.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b962d5404f39128a75d92d6c20f21b926301e3f4afa6470258d30a3389739c0f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 21:58:20 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xfrnkqcphejiu5ozfvwcb4q3sjrqdy7uv6teoasy2mfdhclttqhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b962d5404f39128a75d92d6c20f21b926301e3f4afa6470258d30a3389739c0f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

img b962d5404f39128a75d92d6c20f21b926301e3f4afa6470258d30a3389739c0f

(this sample)

AveMariaRAT

Executable exe 97abfa66c19a23ccabb59254cf91e13eb56d9d64df727f66034ac5a063cc566c

  
Dropping
MD5 1e607a2d4beb7230f8344f932c66e34b
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97abfa66c19a23ccabb59254cf91e13eb56d9d64df727f66034ac5a063cc566c

Comments