MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf436bae3e4a50f6e565734b41bc576843113eaeabd86b493848527b3d3c933d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf436bae3e4a50f6e565734b41bc576843113eaeabd86b493848527b3d3c933d
SHA3-384 hash: 3ac7e72bcf978c9e1dd8f08610ccaf05677a85c3b804e16c5eae5fc58de290db66dfcbed9b95f3a7707cb32e61f0aae5
SHA1 hash: 6cc74c58da2a1be40f4316cbda4d6a7f28a4ce31
MD5 hash: 7afa3111137c9a2f21bff41ba96a984c
humanhash: venus-lion-moon-winner
File name:CST200047.arj
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:259'894 bytes
First seen:2020-10-08 13:13:43 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:SrWjXF9MTKvX1dxnOr/oCAdViPwUbxsYAQrcBVY96Ye4RVJ77nzluVp:Sr+XwwFKr/oCYViPhxsYzsVY96Ye4RVY
TLSH 8B44232A428BDE54F06CB3D877703987C25E00EE58832DAF08DDDBF5052AA569C0D77A
Reporter abuse_ch
Tags:arj AveMariaRAT RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mail.aberniew.com
Sending IP: 45.95.169.136
From: info@toptap.si
Subject: PO 19218 - 110920 (Carrier Transicold)
Attachment: CST200047.arj (contains "CST200047.exe")

AveMariaRAT C2:
172.111.210.207:2829

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf436bae3e4a50f6e565734b41bc576843113eaeabd86b493848527b3d3c933d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 06:45:42 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5bwxlr6jjipnzlfonfudpcxnbbrcpvovpmgwsjyjbjhwpj4sm6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bf436bae3e4a50f6e565734b41bc576843113eaeabd86b493848527b3d3c933d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

arj bf436bae3e4a50f6e565734b41bc576843113eaeabd86b493848527b3d3c933d

(this sample)

AveMariaRAT

Executable exe 880a8ee4e17767269813cd357c07c5453bc9cff047a2c201d6477d4b27c016c4

  
Dropping
MD5 7c7704246da617de120823ba2b49dd97
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 880a8ee4e17767269813cd357c07c5453bc9cff047a2c201d6477d4b27c016c4

Comments