MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95305595e6858d0f37de53a6fcde486fca7b4d44a7742d6f6387fb1677d78745. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 4

Intelligence 4 IOCs YARA 5 File information Comments

SHA256 hash:	95305595e6858d0f37de53a6fcde486fca7b4d44a7742d6f6387fb1677d78745
SHA3-384 hash:	41c34fc72e5847e96ed2310f3cc7d90ae36f4209b81ae29696e19bdb5bfcb470fcdebde170486b090ccfb107f160b27e
SHA1 hash:	4456d49a9bbda19964ed4fe2df288bd75c1ce61a
MD5 hash:	c28b2eafd7e6b35a4370af6c2bd73887
humanhash:	mars-bluebird-cold-johnny
File name:	c28b2eafd7e6b35a4370af6c2bd73887.exe
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	1'528'322 bytes
First seen:	2020-07-10 11:58:10 UTC
Last seen:	2020-07-10 17:06:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	67b246f5bc27b6a1b537c01e50aff789 (3 x RemcosRAT, 3 x AveMariaRAT, 1 x ParallaxRAT)
ssdeep	12288:rdNBlWS3MVbDQmQQSzZEjBcoIdGmYbbxjYg:RbvcbDQmQzGjz2Gnb1r
Threatray	370 similar samples on MalwareBazaar
TLSH	B7657D22F2D18537F16A1A79CC4B97A85839BDD33D24AC463BE83D0C5F39681782A197
Reporter	abuse_ch
Tags:	AveMariaRAT exe nVpn RAT

abuse_ch

AveMariaRAT C2:
185.140.53.54:1186

Hosted on nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/24381/

Detection(s):

SecuriteInfo.com.BScope.Trojan.Downloader.1470.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95305595e6858d0f37de53a6fcde486fca7b4d44a7742d6f6387fb1677d78745/

Threat name:

Win32.Trojan.RemcosCrypt

Status:

Malicious

First seen:

2020-07-10 12:00:06 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=suyflfpgqwgq6n66kotpzxsin7fhwtkeu52c233dq75rm56xq5cq._file

Verdict:

malicious

AveMariaRAT

38d4e4ea5e9b15b4d221cc6627a7b088a54964dfe95b49173a45bc5f9177a249

AveMariaRAT

5d4ee1d47b298efcc8475545d1d28ccaf61192def8085636e225019cced7f9cd

AveMariaRAT

7f261df83598926b168c3515bde5a345dba7828d5bcbdedff5fc55cd16ec23a8

AveMariaRAT

8afd54f2ed0af6d9593b0985cec1604748ca753900859fe4ee225d21b574e55e

AveMariaRAT

8fa8f67945e7ad85b3afc20abed666c8c69e9b0e592b9002c5bb78438d093d3e

AveMariaRAT

90d5792fd0a2ab859f120bef8f12a28c8f7e4119a43054c22db57e76c7b386a0

AveMariaRAT

934609a4e6bbf6eda68c1a09fbd0d5e331229f974148c21aa99add9f94171ec1

AveMariaRAT

df2688f6f88ea0e66b46d856e514adf25f8456cb4e45c849233799e17b1171e3

AveMariaRAT

f37f40245387cf924b4692267251875273ef75ad03fa9f92d73ab021f5c9e307

AveMariaRAT

+ 360 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence

Link:

https://tria.ge/reports/200710-s25cfr8las/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run entry to start application

Legitimate hosting services abused for malware hosting/C2

Adds Run entry to start application

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	win_ave_maria_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator