MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efb523ec3d51b33ab6040319ec026848ac3eee10a1d99e480af8bdee772dc2dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efb523ec3d51b33ab6040319ec026848ac3eee10a1d99e480af8bdee772dc2dc
SHA3-384 hash: 9e9af3cffd484a8513187c6848a4ce60fecf94c8b5cbd75d4299fac4a7c922954c903b29378b6d7e8d50b1aba6280d83
SHA1 hash: 1d38c109ee150f64d867d6d5f55c5c1d93264564
MD5 hash: 64a0938eecb6eff4cef066f22ed87b7e
humanhash: kentucky-iowa-seven-uncle
File name:invoice 203020.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:522'605 bytes
First seen:2020-05-28 05:23:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:tNrPwxJVSNHkkv2nGUypzkmPh2xVmry7KW6k5HGd:tBw94Ekv2GUypzXAVmryWImd
TLSH 5FB423B1FB7BB8A4E1C1616DEA07DEBB111626D00143C609B449B81B5BE3B3D89C1E7C
Reporter abuse_ch
Tags:AveMariaRAT RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: standfordgroups.com
Sending IP: 62.173.142.172
From: Anne Shui <zhkj@vip.163.com>
Subject: PAYMENT REJECTED
Attachment: invoice 203020.zip (contains "invoice 203020.exe")

AveMariaRAT C2:
216.38.2.212:5200

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24066.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dniagjn
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 05:36:48 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip efb523ec3d51b33ab6040319ec026848ac3eee10a1d99e480af8bdee772dc2dc

(this sample)

AveMariaRAT

Executable exe 9f8f76b6e791499bedf04630e7942a2e2d4792969d3c219b598f7a20596f767a

  
Dropping
MD5 ddac94bd5178257ad871cf06182745e2
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f8f76b6e791499bedf04630e7942a2e2d4792969d3c219b598f7a20596f767a

Comments