MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ab4dfa57029017fbf39c7c78b9df1ad9b2514b2e916973cdf88be79b875b5b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ab4dfa57029017fbf39c7c78b9df1ad9b2514b2e916973cdf88be79b875b5b9
SHA3-384 hash: 71d3f9f3c22737506c10428646fa2c9838cf10b895cdce370cebb5a9d5300d67304d23a1f30e422db3f6e107855735dc
SHA1 hash: b6bb9c46637f61ff961aef72ca5be46a7f1ded3b
MD5 hash: 92f0933459d4442d34b978602ef6d0fb
humanhash: princess-social-four-fruit
File name:New Order.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:257'308 bytes
First seen:2020-08-10 09:54:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:IBhvyIkh5QzpE9cEUSh/rGj4gkqmzM1zCnI9ZUI/:0hyIk8gJHOCMxwI/
TLSH 10442394990852F6995E232E35FD1F7DB7887F0C912E8B46BEDC098F33AA01CC8D5195
Reporter abuse_ch
Tags:AveMariaRAT rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: www.fsc-netcom.biz
Sending IP: 211.16.211.187
From: anonymousfox-ei9vd@res-mar.ru
Subject: Purchase Detailed Inquiry
Attachment: New Order.rar (contains "New Order.exe")

AveMariaRAT C2:
chefdnshot.ddns.net:40951 (185.19.85.138)

% Information related to '185.19.84.0 - 185.19.85.255'

% Abuse contact for '185.19.84.0 - 185.19.85.255' is 'abuse@datawire.ch'

inetnum: 185.19.84.0 - 185.19.85.255
netname: DATAWIRE-DATACENTERS
descr: CUSTOMERS ZG01
country: CH
admin-c: DA4314-RIPE
tech-c: DA4314-RIPE
status: ASSIGNED PA
mnt-by: DATAWIRE-NOC
created: 2013-09-23T14:18:55Z
last-modified: 2013-09-23T14:18:55Z
source: RIPE

role: DATAWIRE AG
address: Hinterbergstrasse 22
admin-c: SH3634-RIPE
tech-c: SH3634-RIPE
nic-hdl: DA4314-RIPE
mnt-by: DATAWIRE-NOC
created: 2012-01-03T15:42:22Z
last-modified: 2013-08-25T14:21:45Z
source: RIPE # Filtered
abuse-mailbox: abuse@datawire.ch

% Information related to '185.19.84.0/22AS48971'

route: 185.19.84.0/22
descr: DATAWIRE AG DATACENTERS
origin: AS48971
mnt-by: DATAWIRE-NOC
created: 2013-03-07T20:43:03Z
last-modified: 2013-03-07T20:43:03Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ab4dfa57029017fbf39c7c78b9df1ad9b2514b2e916973cdf88be79b875b5b9/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lk2n7jlqfeax7pzzy7dyxhprvwnskffs5eljopg7rc7htodvww4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5ab4dfa57029017fbf39c7c78b9df1ad9b2514b2e916973cdf88be79b875b5b9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 5ab4dfa57029017fbf39c7c78b9df1ad9b2514b2e916973cdf88be79b875b5b9

(this sample)

AveMariaRAT

Executable exe b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3

  
Dropping
MD5 175695e5766298896b7c780b2167ef55
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3

Comments