MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9f757de37c9f8092ff3dbaba6b0adfecd5b97e5f3bb521647f4290918a4bc0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9f757de37c9f8092ff3dbaba6b0adfecd5b97e5f3bb521647f4290918a4bc0d
SHA3-384 hash: 78e79121b73567bdbd6ffeb0b3d412abf3dac660a3c4762930564fdbc70682b26429e276f42158edf2aa2a03caa5d51a
SHA1 hash: 682ade1077155b7d506da86609f03aab3d1fad30
MD5 hash: 52295215fd5627afbeb874714e5fdff6
humanhash: red-utah-uranus-north
File name:C28 - 35782025 BLUELINXCO RFQ.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:553'271 bytes
First seen:2021-04-01 07:27:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:t9kmN7rl/b458kPVIYmqRZOs0gNK0mB/YuSaTbaujebNGT5:t9kelTK8wbmu40q/YuSaDebNGT5
TLSH 3BC423B45678ADE0DB438A10CA027014F1A311FC2EBB62B516F9ABBE27475115C3A7DF
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns1.hanyuan.pw
Sending IP: 104.168.137.9
From: ivy@hanyuan.pw
Subject: C28 - 35782025 BLUELINXCO RFQ
Attachment: C28 - 35782025 BLUELINXCO RFQ.rar (contains "klz4gyUavm3BYrK.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9f757de37c9f8092ff3dbaba6b0adfecd5b97e5f3bb521647f4290918a4bc0d/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 07:28:11 UTC
AV detection:
3 of 47 (6.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zh3vpxrxzh4asl7t3ov2nmfn73gvxf7f6o5vefsh6quqsgfexqgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9f757de37c9f8092ff3dbaba6b0adfecd5b97e5f3bb521647f4290918a4bc0d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar c9f757de37c9f8092ff3dbaba6b0adfecd5b97e5f3bb521647f4290918a4bc0d

(this sample)

AveMariaRAT

Executable exe f1b5c3f7c1ee438590757e114f1c379f6c3d5fc7b349cad583976106737beb61

  
Dropping
MD5 a4f1d30c779341883a5aa160f647eea6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1b5c3f7c1ee438590757e114f1c379f6c3d5fc7b349cad583976106737beb61

Comments