MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4782413ba851981cd0df86490c64e5be57861441cd7d896ccd9ca852ba6ed45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4782413ba851981cd0df86490c64e5be57861441cd7d896ccd9ca852ba6ed45
SHA3-384 hash: bab8e8a04434a662abf54eb2f4a927b37f27d3201d63c779cf503e934eab8dfd1920303e8744348d843a7702d830923d
SHA1 hash: d3be821eb5f8d802f9360b48dcc6ce69ff53929f
MD5 hash: 1dffe87574c50e4995582bcbf48b8b2a
humanhash: connecticut-carbon-eleven-magazine
File name:RFQ-OM-3994 - Closing Date 30.04.2021 -MEPF-PO-2020-060PDF.z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:485'471 bytes
First seen:2021-04-08 06:55:11 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:tz9axskvIkDmyQfR2EHpdkUOG99jH4VL1s4Q1Oqnwrn:7aGkvDmykpR9jFRwrn
TLSH F2A423D6BA90C4689BA3C1E79C509F7ECC0E41F141F258E27A82875738DF87865CA3E5
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: s-r.co.kr
Sending IP: 121.254.168.147
From: purchase dpt. <8150110@naver.com>
Subject: QUOTE REQUEST - ALIBABA BUYER
Attachment: RFQ-OM-3994 - Closing Date 30.04.2021 - MEPF-PO-2020-060PDF.z (contains "RFQ-OM-3994 - Closing Date 30.04.2021 - MEPF-PO-2020-060PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c4782413ba851981cd0df86490c64e5be57861441cd7d896ccd9ca852ba6ed45/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 06:56:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yr4cie52qumydtin7bsjbrsolpsxqykedtl5rfwm3hfikk5g5vcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/c4782413ba851981cd0df86490c64e5be57861441cd7d896ccd9ca852ba6ed45

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

z c4782413ba851981cd0df86490c64e5be57861441cd7d896ccd9ca852ba6ed45

(this sample)

AveMariaRAT

Executable exe 49dffdd2bd774d0cdb2924d91566c62fbca3ddb766e4f92213cfba1b5e1a184d

  
Dropping
MD5 7dc585537591e94f6d3355d39399eb7f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 49dffdd2bd774d0cdb2924d91566c62fbca3ddb766e4f92213cfba1b5e1a184d

Comments