MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 390cacc3443b0467da38f28ba37805e8beb0b06c9dd9c809075d7f9fac54ab84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	390cacc3443b0467da38f28ba37805e8beb0b06c9dd9c809075d7f9fac54ab84
SHA3-384 hash:	bd68d7ffe47c315857a5813c93757ec4c34d57efd3d5adc342f2c4655c455a85a436fae27a806033a9bc49c7062eb070
SHA1 hash:	97a1fdc2380e032ce3ffda45e7a01b5109d153bd
MD5 hash:	f2ceae70f686b16c0ae089c447bafaa5
humanhash:	fish-pasta-grey-july
File name:	DHL_CUSTOMERS_FORM.IMG
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	2'162'688 bytes
First seen:	2020-07-21 09:47:18 UTC
Last seen:	Never
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	6144:8t/aVN8fi4qXVUAkPL35hv2fznVWUmir1D3O2kwRpk:QaVN8fxqFUAkPL0jVWaH
TLSH	88A56C133AC1ED5AC1FE00B0C9B3DFE3396AFE649E10413693AA3B5E0D55198672C9D9
Reporter	abuse_ch
Tags:	AveMariaRAT DHL img nVpn RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: clubspace8.vacationpubsandclubs.com
Sending IP: 69.36.182.206
From: DHL Accounts Dept. <customersservice@dhl.com>
Reply-To: purchase@edleuros.com
Subject: DHL EzyBill – Invoice No: TNSR000153181
Attachment: DHL_CUSTOMERS_FORM.IMG (contains "DHL_CUSTOMERS_FORM.exe")

AveMariaRAT C2:
91.193.75.120:2525

Hosted on nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@privacyfirst.sh'

inetnum: 91.193.75.0 - 91.193.75.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
abuse-c: ACRO34258-RIPE
mnt-by: PRIVACYFIRST-MNT
mnt-by: RIPE-NCC-END-MNT
status: ASSIGNED PI
org: ORG-KHd1-RIPE
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2020-07-15T15:25:07Z
source: RIPE