MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f04f53f4f50e5f98184f7b5ea7c89708517558cc91e6baec17807b23bb3bd971. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f04f53f4f50e5f98184f7b5ea7c89708517558cc91e6baec17807b23bb3bd971
SHA3-384 hash: b756f6db89a2d052979199348a50195ceef84a82d243ed207c5902fa93385625907372819e099d6cc7fdf44d540650b5
SHA1 hash: bc823d44194c314ca8d66d374b540bde3df957b8
MD5 hash: c6250e724e632791c76458d993f5040e
humanhash: ceiling-mango-monkey-uniform
File name:RFQ-PO-0075609-MT002-08-05-20-Order_Specfication,xlxs.7z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:276'391 bytes
First seen:2020-08-05 08:11:04 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:VGfhPTaMegN+SO9rujhM5J0IhKTDXy3STGfv:VW1KM+2hM5JETD+fv
TLSH C844232E0876A16893019DDCBEEC94F49D15BE87E496883F5027D6772492C0D8CA7AEC
Reporter abuse_ch
Tags:7z AveMariaRAT geo KOR RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mail-smail-vm41.hanmail.net
Sending IP: 203.133.180.229
From: 경기샤링 <skadudhg@hanmail.net>
Subject: 新订单-样本-报价规范
Attachment: RFQ-PO-0075609-MT002-08-05-20-Order_Specfication,xlxs.7z (contains "RFQ-PO-0075609-MT002-08-05-20-Order_Specfication,xlxs.exe")

AveMairaRAT C2:
54369253290033.sytes.net:52200 (104.37.175.147)

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.25956.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f04f53f4f50e5f98184f7b5ea7c89708517558cc91e6baec17807b23bb3bd971/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:13:04 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bhvh5hvbzpzqgcppnpkpsexbbixkwgmshtlv3axqb5shoz33fyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f04f53f4f50e5f98184f7b5ea7c89708517558cc91e6baec17807b23bb3bd971

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

7z f04f53f4f50e5f98184f7b5ea7c89708517558cc91e6baec17807b23bb3bd971

(this sample)

AveMariaRAT

Executable exe da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a

  
Dropping
MD5 abe9a8e82fdc2bf7ef404d8e6549ba16
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a

Comments