MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab57cb56face958116a0e09ea0f97d603306828558c7a474df4fea21df511bb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	ab57cb56face958116a0e09ea0f97d603306828558c7a474df4fea21df511bb6
SHA3-384 hash:	5cd33bbaa617fa87e48a152e6c6ff50d84b09dfe5ab51e4cbac53896b76d2e9363ef441b1cca75f5034799a8289ac866
SHA1 hash:	7931df2d3e3d609b7a4ad4f9b5441b5c4bd7ed44
MD5 hash:	08c9342c319e09f2665f64146c62c9a8
humanhash:	failed-mirror-louisiana-leopard
File name:	DHL SHIPMENT 0942002 VDATA FORM UPDATE.IMG
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	1'245'184 bytes
First seen:	2020-07-16 18:54:04 UTC
Last seen:	Never
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	12288:VV2k4zUZCW32jWNvYlQBBvWHz+FxSAJS2SfT/zVUB:VwW3MWlYaPI
TLSH	734539D83510719EC41E8D768964DC30A6206C62F7FBD20663CB6E9F7A3D696CF112A2
Reporter	abuse_ch
Tags:	AveMariaRAT DHL img nVpn RAT

abuse_ch

Malspam distributing unidentified malware:

HELO: mtk1.illnp.com
Sending IP: 45.95.171.171
From: DHL Express | United States <noreply@dhl.com>
Subject: [Shipment#US0271938432] Your shipment needs Urgent Attention!
Attachment: DHL SHIPMENT 0942002 VDATA FORM UPDATE.IMG (contains "DHL SHIPMENT #0942002 VDATA FORM UPDATE.exe")

Unknown RAT C2:
mitty1.freemyip.com:1996 (91.193.75.54)

Hosted on nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@privacyfirst.sh'

inetnum: 91.193.75.0 - 91.193.75.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
abuse-c: ACRO34258-RIPE
mnt-by: PRIVACYFIRST-MNT
mnt-by: RIPE-NCC-END-MNT
status: ASSIGNED PI
org: ORG-KHd1-RIPE
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2020-07-15T15:25:07Z
source: RIPE