MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27046596554dbd66334ad33d6db896e36d8b7ad3e3c1e639226ae64ade8fb365. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	27046596554dbd66334ad33d6db896e36d8b7ad3e3c1e639226ae64ade8fb365
SHA3-384 hash:	7a5cc7e092efde4b8fa23c70b04c833a61a3da00407d25fa063fc0d380247518a88ac4225f826a0bc86dc87c5bd2891f
SHA1 hash:	4ee375d7adff298d40c47462ca2220062ef1364c
MD5 hash:	b0c563030bbc1d91840182156a830e1c
humanhash:	beer-earth-potato-india
File name:	invoice and credit note against the pending payments.rar
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	1'564'396 bytes
First seen:	2020-10-15 13:09:46 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:AnEl855XMPZ6GPSFVUqo3UO8GgdYo0LkNEnx8cUWAVZMZZIXZGLN5Lmkmpm7q:5opMPZ6GPMVho3Z8koFEnuw3ImErm7q
TLSH	327533E18DB121EB1E27E8B8DDEF2905739584B1A4163B15F6202B3F5EF0954CA7D8B0
Reporter	abuse_ch
Tags:	AveMariaRAT nVpn rar RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: hosted-4-client-dedicated-live-server.hashimmurrah.co
Sending IP: 103.102.239.124
From: FATHI DAHER <f.daher@albuhaira.com>
Subject: invoice and credit note for payment
Attachment: invoice and credit note against the pending payments.rar (contains "invoice and credit note against the pending payments.exe")

AveMariaRAT C2:
kkkindo.ddns.net:8787 (185.244.30.30)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE