MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33df012547d224a983a67206ebb15b8d6f649b08db2a08704dd89b56bef6e438. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33df012547d224a983a67206ebb15b8d6f649b08db2a08704dd89b56bef6e438
SHA3-384 hash: 5fdf2c6d50a02b1666371ab6ba928be74402f1c3d62b111bb00152457280122a8ca8845546d2b9301520e8140ed0e39d
SHA1 hash: f1ce605211b296dc0e1a1417ae77449506834f1e
MD5 hash: e99c22aa1bddcbe7c113560a9ece069f
humanhash: spaghetti-texas-bakerloo-social
File name:PO 440099873009899978622020.doc.z
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:233'725 bytes
First seen:2020-07-21 06:25:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Y6ltZui1GMUiQx187vVbFwwVOn/Jn9wwFZeBKj7ZAAyXOUaxV29U:llPui1Ar1uJFwwM/4Qj78XB+
TLSH 9634130811474A0FC92FC566699D5D31384E3B33E34A6706B33F5D9EC9EF2B4C2296A6
Reporter abuse_ch
Tags:AveMariaRAT nVpn RAT z


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: WIN-KP3NFSDUTC3
Sending IP: 96.9.226.75
From: Info <will@zfsungold.com>
Reply-To: will@zfsungold.com
Subject: Best Prices For New Order
Attachment: PO 440099873009899978622020.doc.z (contains "PO 440099873009899978622020.exe")

AveMariaRAT C2:
185.165.153.249:2626

Hosted on nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacyfirst.sh'

inetnum: 185.165.153.0 - 185.165.153.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-AT2
country: AT
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2020-07-14T13:31:45Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WYG.11412.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33df012547d224a983a67206ebb15b8d6f649b08db2a08704dd89b56bef6e438/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:27:05 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gppqcjkh2iskta5goidoxmk3rvxwjgyi3mvaq4cn3cnvnpxw4q4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/33df012547d224a983a67206ebb15b8d6f649b08db2a08704dd89b56bef6e438

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 33df012547d224a983a67206ebb15b8d6f649b08db2a08704dd89b56bef6e438

(this sample)

AveMariaRAT

Executable exe 5743addf52ee0b08652510e2d1e295cc787bad9a0c45fc98df9980a9c5b9cee4

  
Dropping
MD5 5e07f19e309de52973dbc42564a70a52
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5743addf52ee0b08652510e2d1e295cc787bad9a0c45fc98df9980a9c5b9cee4

Comments