MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4b095f06290c399942b30688e8bbc0c42261ef7220f51739160b71cf6c89571. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4b095f06290c399942b30688e8bbc0c42261ef7220f51739160b71cf6c89571
SHA3-384 hash: 87415c4c55f0e8918f138c1f00e7adb25b0367a6f71cf9e5ef3f4f9bb6da36138e268fba21a7de800c39e42e20ad7f46
SHA1 hash: 69859db2cc0e44013fea4fc9ade76a46e9515adc
MD5 hash: 4f5b5a4ed73cb3b195dda09c8ee0d7c0
humanhash: river-gee-mango-magnesium
File name:Proforma fatura.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:491'261 bytes
First seen:2021-01-12 18:05:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:j3BGEphNI4GWdezoSszFmJ9VNXiT/6Jfpau4REX2O:j3BGIhNJGWczGFmJ9VtiT6JfkhREX2O
TLSH A7A423E8BF6FE5F3277B547786DDC6235E400686B4477B5B63AB22602F13EA021844C9
Reporter abuse_ch
Tags:AveMariaRAT rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: business104-1.web-hosting.com
Sending IP: 162.0.215.118
From: info@sxcfdzgs.com
Subject: Re:Fatura
Attachment: Proforma fatura.rar (contains "Proforma fatura.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.20650.21784.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c4b095f06290c399942b30688e8bbc0c42261ef7220f51739160b71cf6c89571/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 18:06:12 UTC
AV detection:
8 of 44 (18.18%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysyjl4dcsdbztfblgbui5c54brbcmhxxeihvc44rmc3rz5wisvyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c4b095f06290c399942b30688e8bbc0c42261ef7220f51739160b71cf6c89571

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar c4b095f06290c399942b30688e8bbc0c42261ef7220f51739160b71cf6c89571

(this sample)

AveMariaRAT

Executable exe fc2795532bba5d9bbdb746abaf999bf848677a9869e3d44bba53b5e60929aeac

  
Dropping
MD5 352a79b4fe6959ca79ab52e1366a5db0
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc2795532bba5d9bbdb746abaf999bf848677a9869e3d44bba53b5e60929aeac

Comments