MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5685ce12e8051291377782853ac10d949c243bde5792cc143b35a4be799f730. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5685ce12e8051291377782853ac10d949c243bde5792cc143b35a4be799f730
SHA3-384 hash: 8c349345d6c16e4cb3f2c769fcbfb902a8c8241c61172c14385ee13b426750944fdcaf827965a671a883b9ed37469b89
SHA1 hash: 8a3c1f3714f6a8f400fb3c6bc369b2203aa833fd
MD5 hash: 9298e25c6befcd0f3e0357eb4f226758
humanhash: undress-alanine-alpha-hamper
File name:uncleared invoice Inv00638 for Terminator #60003x and revised due Quotation.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:245'975 bytes
First seen:2020-06-15 12:37:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:cBv9FbGJOsWP7B/1cjdVQnrgS0RcPC8rDrogoTgkJbxqAjuan:ch9RGJuNydEzxUDb3juQ
TLSH 18342390E5F9F8BB1880DBA344AB2F9235826231E349E758E1F9F7173C12A68450D75F
Reporter abuse_ch
Tags:AveMariaRAT RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp106.iad3b.emailsrvr.com
Sending IP: 146.20.161.106
From: thendricks <thendricks@netamlines.com>
Subject: Onedrive | Last Reminder, redacted@threatwave.com has 2 New Documents
Attachment: uncleared invoice Inv00638 for Terminator #60003x and revised due Quotation.zip (contains "uncleared invoice #inv00638 for Terminator #60003x and revised due Quotation.exe")

AveMariaRAT C2:
185.136.159.244:5200

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Trojan.Siggen9.53219.13303.18233.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Streamer
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:39:08 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4vufzyjoqbisse3xpaufhlaq3fe4eq554v4szqkdwnnexz4z64ya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip e5685ce12e8051291377782853ac10d949c243bde5792cc143b35a4be799f730

(this sample)

AveMariaRAT

Executable exe 7dff88b3b51db9f32b155133aba7bff719133a881082bbffd5dad02f7acf79e6

  
Dropping
MD5 8d7f79c76d8ae3323bc1b8b6dde03afe
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7dff88b3b51db9f32b155133aba7bff719133a881082bbffd5dad02f7acf79e6

Comments