MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db3f7fc7307eb0caea28115b12be22680f7db3c37bc838e6f1e214ec402d0df4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db3f7fc7307eb0caea28115b12be22680f7db3c37bc838e6f1e214ec402d0df4
SHA3-384 hash: acffb6cfed26e702a8f947570ea6076b18295459245c66265818c9eca5101e0f03816bcc0838b2a78a99e4827f1f86bf
SHA1 hash: 3fb62bdd352c3292c480146a692111518a717e20
MD5 hash: fbe092c23a18420737d5706de392469f
humanhash: item-jupiter-kansas-magazine
File name:JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:632'697 bytes
First seen:2021-01-19 16:21:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:8OoL/ZeC7MSFVgdEKvXarHI7j6vVUnZXzCNZ0N7FUYiVA4bG:8OoL/7Je6KvKHIP6vVoxS0N5SvG
TLSH 5BD42393C20A228B8E94CDAD36D74591B8AE805C0F4EFB03997158AF482B55F7707DA7
Reporter abuse_ch
Tags:AveMariaRAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: host.usabestserver.com
Sending IP: 162.214.72.205
From: sales_vic@charmedleather.com
Subject: QUOTATION REQUEST
Attachment: JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.zip (contains "JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.exe")

AveMariaRAT C2:
urchy.duckdns.org:30251

Intelligence

File Origin
# of uploads :
1
# of downloads :
210
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.516.11446.30275.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db3f7fc7307eb0caea28115b12be22680f7db3c37bc838e6f1e214ec402d0df4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 16:21:08 UTC
AV detection:
14 of 44 (31.82%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3m7x7rzqp2ymv2ricfnrfprcnahx3m6dppedrzxr4ikoyqbnbx2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/db3f7fc7307eb0caea28115b12be22680f7db3c37bc838e6f1e214ec402d0df4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip db3f7fc7307eb0caea28115b12be22680f7db3c37bc838e6f1e214ec402d0df4

(this sample)

AveMariaRAT

Executable exe ae0867ee2b8d439245831fa1884fc5ef80cf9e38e43d1059e8030d2c433e4040

  
Dropping
MD5 86c59d1e4de693a0f5d2ffe3b1cd8ef9
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae0867ee2b8d439245831fa1884fc5ef80cf9e38e43d1059e8030d2c433e4040

Comments