MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bc9aeacdb68f02548af3cbcf26035cfe312ed7084716390a9baf1e6f37583bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	2bc9aeacdb68f02548af3cbcf26035cfe312ed7084716390a9baf1e6f37583bc
SHA3-384 hash:	92930faab89e323c50fb82213508c0346d1a73b31f474c7dff416e67062af02f32a7bb3d3b335af2bb2a4b028bf8c058
SHA1 hash:	f56929f1d65f6ec70346d348657ea31caf712273
MD5 hash:	6d759908222a168230286f5f8ff1d418
humanhash:	massachusetts-avocado-jig-rugby
File name:	ZTECHORDERPROCUREMENT2020.06.IMG
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	1'245'184 bytes
First seen:	2020-06-04 17:50:37 UTC
Last seen:	Never
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	6144:3rVWTPtdNikCddIwVszNQM/ck4YvntuwJD8gxOeOMUkH+xZX+jI5M7IrYd2t/uuy:bVWPt5IIwVs1v9PUk+niUrYkjV3b
TLSH	EE458D62B7A24477D133077D8C1BCE78643BBD156E78684B2AEA7C4C9F36282352B147
Reporter	abuse_ch
Tags:	AveMariaRAT img nVpn RAT

abuse_ch

Malspam distributing unidentified malware:

HELO: bosmailout03.eigbox.net
Sending IP: 66.96.189.3
From: Khan Industries <admin@zbindustry-com.tk>
Reply-To: exportscoin@gmail.com
Subject: Re: procurement NO 5678 2020
Attachment: ZTECHORDERPROCUREMENT2020.06.IMG (contains "ORDERPROCURE20206.exe")

Unknown RAT C2:
79.134.225.43:5908

Hosted on nVpn:

% Information related to '79.134.225.0 - 79.134.225.63'

% Abuse contact for '79.134.225.0 - 79.134.225.63' is 'abuse@anmaxx.net'

inetnum: 79.134.225.0 - 79.134.225.63
netname: BASEL-HOSTING-225-0
country: CH
admin-c: AM38880-RIPE
tech-c: AM38880-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
created: 2016-04-17T00:42:52Z
last-modified: 2016-04-18T06:23:19Z
source: RIPE
remarks: abuse-c AIS166-RIPE
org: ORG-AGIS12-RIPE