MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faa6c6b810e7afbc36149642c32e273e05cad6297319f27b61abd7a84dc514cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	faa6c6b810e7afbc36149642c32e273e05cad6297319f27b61abd7a84dc514cf
SHA3-384 hash:	9e8587e3f8dac19bde6014e2ab43c88c20e0c0a293c709d8dec7d1e107c2c1a36180fba95785d6880e0f1e2106663210
SHA1 hash:	a2a5ae5076d68f2c9ab6cba84ae38197f78930fe
MD5 hash:	be67f4489137e5021bafe02425395748
humanhash:	single-alanine-stairway-undress
File name:	PO.946577-Order_Quote,pdf.7z
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	273'081 bytes
First seen:	2020-08-05 08:33:54 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-rar
ssdeep	6144:GNeGDdMiI8EZXWtlCvEGciMCC2JZHdW+c7:Ye2I8ESUMi7lVa
TLSH	7C4423BCCD6EA2C212664A2524DB099249BE78C0FB5046F65D74FB233132B1E3DCD49B
Reporter	abuse_ch
Tags:	7z AveMariaRAT geo KOR nVpn RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: mail-smail-vm89.hanmail.net
Sending IP: 211.231.106.164
From: 이영신 <lys2513@hanmail.net>
Subject: 报价订单和公司规格请求
Attachment: PO.946577-Order_Quote,pdf.7z (contains "PO.946577-Order_Quote,pdf.exe")

AveMariaRAT C2:
194.5.97.10:6022

Hosted on nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@kgb-vpn.org'

inetnum: 194.5.97.0 - 194.5.97.255
netname: NET-NINAZU
remarks: ------------------------------------------
remarks: * This network is used for a VPN service.
remarks: * No logs are stored in any shape or form.
remarks: ------------------------------------------
country: EU
admin-c: NVS100-RIPE
tech-c: NVS100-RIPE
org: ORG-NVS2-RIPE
mnt-by: NINAZU-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-02T13:13:48Z
source: RIPE