MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc953fe0297a6052651a8c0f35f7a10632e36d44486875068bfd25f605ef5cca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc953fe0297a6052651a8c0f35f7a10632e36d44486875068bfd25f605ef5cca
SHA3-384 hash: 562507316fc017bf593467ac0453f4b9577cbabc5be3080d7e1476d70732f84bba047a8cccdd28d371021cbf3d9c924e
SHA1 hash: 6cd6f336efd2aa9d6432e0d2f027aa0740bc86fe
MD5 hash: 457bcbf92672b5a65c79cec32b3e4af8
humanhash: uniform-network-papa-tango
File name:Documento de transferencia de Scotiabank749757473008422doc.arj
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:179'393 bytes
First seen:2020-12-04 19:56:32 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 3072:Y8O681zuhVseggkEQVEg2W/LHQCUE2HTI3/Yzs/hvwvFCTqGTEgMM2LKb:YN6QzlYxmGWzwCU7TQAQgCTkmb
TLSH 300423432C40555E9BE1AC4857EB968465ED07799CF3F8730BA91E76CF08ED2218ECB8
Reporter abuse_ch
Tags:arj AveMariaRAT ESP geo RAT Scotiabank


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: vps.mks-tr.org
Sending IP: 45.153.203.51
From: avisos.empresa.infoScotiabank.cl <office@mks-tr.org>
Subject: Aviso de transferencia de fondos
Attachment: Documento de transferencia de Scotiabank749757473008422doc.arj (contains "Documento de transferencia de Scotiabank749757473008422doc.exe")

AveMariaRAT C2:
178.170.138.163:4554

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc953fe0297a6052651a8c0f35f7a10632e36d44486875068bfd25f605ef5cca/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-04 19:57:07 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zskt7ybjpjqfezi2rqhtl55bayzog3kejbuhkbul7us7mbppltfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cc953fe0297a6052651a8c0f35f7a10632e36d44486875068bfd25f605ef5cca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

arj cc953fe0297a6052651a8c0f35f7a10632e36d44486875068bfd25f605ef5cca

(this sample)

AveMariaRAT

Executable exe 48fa514aefde6f61a5fbf181dbcc255f9a5027beeb53f683cc2615889365904c

  
Dropping
MD5 2524a05f0cdea41596dec715e85fcbeb
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 48fa514aefde6f61a5fbf181dbcc255f9a5027beeb53f683cc2615889365904c

Comments