MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c77da8bcb3664e2c59e8c1210e014ff78430b44defaf3e8fcdc81d9203d3bcb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c77da8bcb3664e2c59e8c1210e014ff78430b44defaf3e8fcdc81d9203d3bcb0
SHA3-384 hash: 46bb99b5fc6277204c03f5978c3b47e9e61dce0049c28da3e71b792fb45d4d30114047d1940971cc94b4930d09968290
SHA1 hash: 66bf29001ed06235768c29ce192f831463c95cb5
MD5 hash: 6416254c1ab6f6528c720ea72c172102
humanhash: bluebird-undress-romeo-green
File name:New Order list 854758.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:486'637 bytes
First seen:2020-10-22 07:39:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Hw0SPW1QMi/FuOOR8KiCGweg6KqTljAoXhJ:HocW0WlKqZjAoXj
TLSH 52A4239E57E19B5CA24F1846813856991E485F9F186EC9D234CCC47E30F29F39CA77B0
Reporter abuse_ch
Tags:AveMariaRAT RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: m97173.mail.qiye.163.com
Sending IP: 220.181.97.173
From: chinapanshi <chinapanshi@hfpanshikj.com>
Subject: New Order list #854758
Attachment: New Order list 854758.zip (contains "New Order list #854758.exe")

AveMariaRAT C2:
185.244.30.23:5200

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c77da8bcb3664e2c59e8c1210e014ff78430b44defaf3e8fcdc81d9203d3bcb0/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-22 02:39:08 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y562rpftmzhcywpiyeqq4akp66cdbncn56xt5d6nzaozea6txsya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip c77da8bcb3664e2c59e8c1210e014ff78430b44defaf3e8fcdc81d9203d3bcb0

(this sample)

AveMariaRAT

Executable exe 12b5948d97b523b60b5e0a37aaacfb9df8a8946caa6fefd92fc6a54ee236edcc

  
Dropping
MD5 eb6e57372181a2f6a0d22e182e1f9a40
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 12b5948d97b523b60b5e0a37aaacfb9df8a8946caa6fefd92fc6a54ee236edcc

Comments