MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2373d64d0faf18e1ff7bbb7650d09f6f16cb8244c424679e95e2989e6532a553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2373d64d0faf18e1ff7bbb7650d09f6f16cb8244c424679e95e2989e6532a553
SHA3-384 hash: 3ed571c627fd78bf43fa00467624bb3aee928fdf6880cf5a357777a71a2604a65e21350107c1c76523f0fae411a96762
SHA1 hash: e6d11c08153ee677a8b050e5ff37da0f707cdf5f
MD5 hash: 2a171b6caa9ed6625e9f8355275b5b7c
humanhash: montana-echo-alanine-spaghetti
File name:PDF.56675874665355342764644644554.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:218'682 bytes
First seen:2020-05-25 12:28:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:CryoWeSwIPfAhIjIgJ63vG2e5AOAD7ROD:CrhWIGA+63vG2KvAROD
TLSH A624233938AA81131027716952C072FE79167767B7BE442185CC903E763F1AA3BB272F
Reporter abuse_ch
Tags:AveMariaRAT nVpn rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: megathudanpathippagam.co.in
Sending IP: 104.152.188.111
From: Machiko <sales@megathudanpathippagam.co.in>
Reply-To: sales@megathudanpathippagam.co.in
Subject: RQF-PO/5875
Attachment: PDF.56675874665355342764644644554.rar (contains "PDF.56675874665355342764644644554.exe")

AveMariaRAT C2:
khalifa.dynamic-dns.net:9095 (185.244.30.252)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 12:36:48 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 2373d64d0faf18e1ff7bbb7650d09f6f16cb8244c424679e95e2989e6532a553

(this sample)

AveMariaRAT

Executable exe 33a76af55237d9ba192ee8496fd6c4adc489593705e81c663a890b39e1c92a8e

  
Dropping
MD5 e3839c81995dbb83d6add65d76676048
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 33a76af55237d9ba192ee8496fd6c4adc489593705e81c663a890b39e1c92a8e

Comments