MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d6ab88dbcea5befa028c704b30c0ba465906f2d6de78ce4314120e8a77ff423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d6ab88dbcea5befa028c704b30c0ba465906f2d6de78ce4314120e8a77ff423
SHA3-384 hash: 5c93b22bf889f359fec3f88c3949641325717aa1028f4a3af75cbd366a5361867ed69523493e8f2a9093ac6bbead9a59
SHA1 hash: 08a983afd9ba208e8d0cc0aa8ffe9839555f6dec
MD5 hash: 80c962b6a121247b963d7caca4277286
humanhash: mockingbird-hawaii-golf-quiet
File name:Order Confirmation..zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:350'529 bytes
First seen:2020-05-21 09:14:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:bxjN/J87e/RLuN5nasdoCdHm/9+rA1xdxbDq5TVi2DcrSefsZEy+:bxjVJZ/huNBaCok8+M1xrbDq/iHSfg
TLSH 2574229EBCAFD3B54F8BE7215C392BD210E5FE1064D4D3A689799D62D8900DE8482473
Reporter abuse_ch
Tags:AveMariaRAT RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: standfordgroups.com
Sending IP: 62.173.142.172
From: Ali Omar <Aliomar@omarmachines.com>
Subject: Fwd: Fw: Re: Re: Order Confirmation For Machine Advance Payment
Attachment: Order Confirmation..zip (contains "Order Confirmation..exe")

AveMariaRAT C2:
79.134.225.40:5200

Hosted on nVpn:

% Information related to '79.134.225.0 - 79.134.225.63'

% Abuse contact for '79.134.225.0 - 79.134.225.63' is 'abuse@anmaxx.net'

inetnum: 79.134.225.0 - 79.134.225.63
netname: BASEL-HOSTING-225-0
country: CH
admin-c: AM38880-RIPE
tech-c: AM38880-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
created: 2016-04-17T00:42:52Z
last-modified: 2016-04-18T06:23:19Z
source: RIPE
remarks: abuse-c AIS166-RIPE
org: ORG-AGIS12-RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47900.12160.3027.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 09:36:23 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvvlrdn45jn67ibiy4clgdalursza3znnxtyzzbrieqorj376qrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 2d6ab88dbcea5befa028c704b30c0ba465906f2d6de78ce4314120e8a77ff423

(this sample)

AveMariaRAT

Executable exe 2534d4d9d35acd53aacf73d734a158e8cfd12c9e6a3d3527f2fb1e2dbf5a487d

  
Dropping
MD5 442482180d8c36631e31a4e041691136
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2534d4d9d35acd53aacf73d734a158e8cfd12c9e6a3d3527f2fb1e2dbf5a487d

Comments