MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9d48996e868bd1503e1050f8609d8660774102315c34e2925dbb2a4ba48fad0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9d48996e868bd1503e1050f8609d8660774102315c34e2925dbb2a4ba48fad0
SHA3-384 hash: e09afeac9784c841dd491d39af2f411a750eda4b487c13c56e9b63f3cef890d87fd5c0ab048435f7d5d676d2ff9292f7
SHA1 hash: 469481888e6023d986f368b08433365fbdf2d540
MD5 hash: 6f2ef716e3bc563d0b34b76b4a563933
humanhash: harry-tango-washington-december
File name:IRMOutstandingReport_1594432868602.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:153'174 bytes
First seen:2020-07-13 07:42:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:g/3KSPQYTKY6aWK7rZX6EDaAu9sN1UeDuN3hRdXljFr9/wJRW:CaS5X61+XHpuY1UF3hRdXNYk
TLSH 6DE3130E0B654A5A4FEFD7EE4F75B615908C542A8DC70ECE73481379E2CA36C902A617
Reporter abuse_ch
Tags:AveMariaRAT nVpn RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: rbi.org.in
Sending IP: 37.49.224.241
From: NoreplyEDPMS@rbi.org.in
Subject: Inward_Remittance_(Export)_Outstanding_Report
Attachment: IRMOutstandingReport_1594432868602.zip (contains "IRMOutstandingReport_1594432868602.exe")

AveMairaRAT C2:
91.193.75.66:2035

Hosted on nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2020-06-12T19:27:12Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.58278.727.26.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9d48996e868bd1503e1050f8609d8660774102315c34e2925dbb2a4ba48fad0/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 07:44:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhkitfxinc6rka7bauhymcoymydxiebdcxbu4kjf3ozkjosi7lia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip b9d48996e868bd1503e1050f8609d8660774102315c34e2925dbb2a4ba48fad0

(this sample)

AveMariaRAT

Executable exe 83dc40c5814d63f0ff34410b5d0b73cc9eedec070af5f6934d63f73d562835f8

  
Dropping
MD5 0075c01564d4a4425acccaeb9272d44f
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 83dc40c5814d63f0ff34410b5d0b73cc9eedec070af5f6934d63f73d562835f8

Comments