MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31a217e32d971a05f769bdf4a560cbdc86a7484d80ca90c178a93e9f8321e3ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31a217e32d971a05f769bdf4a560cbdc86a7484d80ca90c178a93e9f8321e3ec
SHA3-384 hash: ab2174448f5b39c9364c90e6883fe5114f4444fcb8da09fc7db6d72b8d7a9f17fe12e567ffab2157aa0a0cf018b157ad
SHA1 hash: 318328d624526e639acad5b44cb338851b414767
MD5 hash: 387d003c5a362dd45364213028e47041
humanhash: seven-angel-enemy-texas
File name:sample order.zip
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:468'703 bytes
First seen:2020-10-08 17:41:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:49oaoouX86EKoQDjRUtQI0XZjNkTssj/obT1RLP11:49o9oTXlJ0p+TsszoNZN1
TLSH B2A4238D722ADC7E4CB302599129FC7F98154D9F63265748B2CE63CC5AD94833960AF3
Reporter abuse_ch
Tags:AveMariaRAT Endurance nVpn RAT zip


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: gproxy7-pub.mail.unifiedlayer.com
Sending IP: 70.40.196.235
From: kfl2.purchase@kemsltd.com
Reply-To: CynthiaChcn0801@outlook.com
Subject: sample order
Attachment: sample order.zip (contains "Ugufpjf4xvKqBFP.exe")

AveMariaRAT C2:
79.134.225.52:5300

Hosted on nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31a217e32d971a05f769bdf4a560cbdc86a7484d80ca90c178a93e9f8321e3ec/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 15:02:35 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ggrbpyzns4nal53jxx2kkygl3sdkoscnqdfjbqlyve7j7azb4pwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/31a217e32d971a05f769bdf4a560cbdc86a7484d80ca90c178a93e9f8321e3ec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 31a217e32d971a05f769bdf4a560cbdc86a7484d80ca90c178a93e9f8321e3ec

(this sample)

AveMariaRAT

Executable exe 913171727a31831be646f7712f8adc3c310affe7897e9556cf1099d743b12913

  
Dropping
MD5 28a2c6a858b39ea8d0fbb84d7846785a
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 913171727a31831be646f7712f8adc3c310affe7897e9556cf1099d743b12913

Comments