MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4a09df65e6fa5f2503ee3f5d70ca01ce70242ad5483c321ccd7ffe9ea885519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4a09df65e6fa5f2503ee3f5d70ca01ce70242ad5483c321ccd7ffe9ea885519
SHA3-384 hash: afc769d7deecb48565bd010476877d9118b796f6847abd721c33fee411452d7ccac5c6f13c29d890635c392d4daf7f5f
SHA1 hash: 7f34da3920f6248f3e46a71f3cf7eb07f5c65c5f
MD5 hash: 6cbd5ed6f4fd08e4e967f7ecad37f5a0
humanhash: floor-carbon-enemy-cat
File name:Bank Copy.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:379'107 bytes
First seen:2020-09-21 04:00:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:YHYE9ZtsDPmdnTD54OW5pvOfUuNFi0wITUGydwr6yPwWhWAMFmr:Y4NjmdpgppuaCYVwrdP06
TLSH 6D8423B905827DD58FA000974E677A1D0E6D302E3BAEFBD0BB04B0E57F525DAD6010EA
Reporter cocaman
Tags:AveMariaRAT rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Ms. Gusti Rudangga" <admin@inouteg.com>"
Received: "from win-rpi9kfja641 (static.88.7.12.49.clients.your-server.de [49.12.7.88]) "
Date: "21 Sep 2020 00:54:34 -0700"
Subject: "Re: Quotation Request (RFQ)"
Attachment: "Bank Copy.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4a09df65e6fa5f2503ee3f5d70ca01ce70242ad5483c321ccd7ffe9ea885519/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-20 23:12:50 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
9 of 43 (20.93%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4sqj35s6n6s7eub64p25odfadttqeqvnksb4giom2776t2uikumq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e4a09df65e6fa5f2503ee3f5d70ca01ce70242ad5483c321ccd7ffe9ea885519

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar e4a09df65e6fa5f2503ee3f5d70ca01ce70242ad5483c321ccd7ffe9ea885519

(this sample)

AveMariaRAT

Executable exe 44631c28fe04318faf429139fae5d95554dc1a9c4fd47b2c2ab2e0fff7667271

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 44631c28fe04318faf429139fae5d95554dc1a9c4fd47b2c2ab2e0fff7667271
  
Dropping
AveMariaRAT

Comments