MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c02219f972254e752f1a0a02515d695443871b094d6072e16bdfda9169f2c52f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c02219f972254e752f1a0a02515d695443871b094d6072e16bdfda9169f2c52f
SHA3-384 hash: 276d1831e6ad6c75786af6ebf189967f52ff72e4c0c9c1655589f59168841b25f77d0da71f2ff85c4f0215c2e03d582b
SHA1 hash: 81474224ead4c82fb8d05542c47a1b7a5e81e049
MD5 hash: d2553eeaec2b596badd0d521db504e06
humanhash: jupiter-aspen-item-missouri
File name:Payment6532.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:281'630 bytes
First seen:2020-08-03 14:03:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gWRvQnXQNDkZoIAuHU0jbPfuXyOnMfSJA6Tojv6xH:gO1oAuHUSPfuXxHJA6UjvW
TLSH 015422EBCBF18CEEFAD5B37B62D398197534032A3747584220E06CA539454C375BA4B2
Reporter abuse_ch
Tags:AveMariaRAT rar


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: poydorus.t.mk
Sending IP: 195.26.152.36
From: transport@bomi10.com.mk <transport@bomi10.com.mk>
Subject: RE: Delayed Payment Due To COVID-19 Situation
Attachment: Payment6532.rar (contains "Payment6532.exe")

AveMariaRAT C2:
marchelexa.hopto.org:3720 (46.38.151.248)

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c02219f972254e752f1a0a02515d695443871b094d6072e16bdfda9169f2c52f/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 14:05:07 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yarbt6lsevhhkly2bibfcxljkrbyogyjjvqhfyll37njc2psyuxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c02219f972254e752f1a0a02515d695443871b094d6072e16bdfda9169f2c52f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar c02219f972254e752f1a0a02515d695443871b094d6072e16bdfda9169f2c52f

(this sample)

AveMariaRAT

Executable exe 57f4246d683336ab606ba5831ce88a0ff47a42de652f72795fe76169195821e1

  
Dropping
MD5 5750b4d4ef032a95c526f127b409811f
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 57f4246d683336ab606ba5831ce88a0ff47a42de652f72795fe76169195821e1

Comments