MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2c80a6752b1e4b72c248a9a3b6c46067f8333ea577d9cac21b33fa1a837e04b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2c80a6752b1e4b72c248a9a3b6c46067f8333ea577d9cac21b33fa1a837e04b
SHA3-384 hash: dca5ad708058c4f564e68f1fd0dd7b3f0deebb93097c87f1ed0f128494836ff51eef3ae3e5b1807bdcc6ae5f59bcfd08
SHA1 hash: 16c2d9721b91727dcca365658312874c37f66b3f
MD5 hash: d2897402ab69fd69d299293af07a17e3
humanhash: sweet-avocado-enemy-east
File name:e-Slip.img
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'507'328 bytes
First seen:2020-07-07 06:21:38 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:oA42+toK52YZ574qMPxVP3YMVde9UptX:oAeT2YEPJb
TLSH 61659E22B2414877C12654B8EE2F73F45E29BE2119C85C973BF8BD9C5FBA6813817193
Reporter abuse_ch
Tags:AveMariaRAT eBay img RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp104.iad3b.emailsrvr.com
Sending IP: 146.20.161.104
From: eBay@ebay.com <bezelyn68@comcast.net>
Subject: eBay Update: Your ebay order #114-4068677-001
Attachment: e-Slip.img (contains "eSlipgqm.exe")

AveMariaRAT C2:
orbitzone.libfoobar.com:24243 (37.120.141.180)

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2c80a6752b1e4b72c248a9a3b6c46067f8333ea577d9cac21b33fa1a837e04b/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 06:23:04 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yleauz2swhslolberkndw3cgaz7ygm7kk56zzlbbwm72dkbx4bfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

img c2c80a6752b1e4b72c248a9a3b6c46067f8333ea577d9cac21b33fa1a837e04b

(this sample)

AveMariaRAT

Executable exe 8f787ad8df4ea3ee0c0940cf5170cccffa5c5783f065b89581de06c53a20b30c

  
Dropping
MD5 643d8efc8b76e065a277f18e31c22789
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f787ad8df4ea3ee0c0940cf5170cccffa5c5783f065b89581de06c53a20b30c

Comments