MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b995eb14128d538f1205c5f38c0adb870f0c791df6ed972454a97fd5c76db472. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b995eb14128d538f1205c5f38c0adb870f0c791df6ed972454a97fd5c76db472
SHA3-384 hash: 45358fbc0718ecb233b8fa11fcfee7196907bfc1c114fb5ddb9c372f88b0391229458e4179971976f1541b105fc36990
SHA1 hash: 9a2b388fa32cd9a4d2de0e2ea9beffb19dc3a80a
MD5 hash: d7d92b2865e86c7b6b2cd8e3503bcab7
humanhash: mockingbird-xray-south-eight
File name:RFQ New Order Quote.cab
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'561'918 bytes
First seen:2020-10-19 13:18:18 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:bGFI5aN382wXOY5Xh3qtJV4l7JMo2YzvJkaYkeLXmQTgiqg2oRsp4FOUnKrOicWl:bMI85wXOY5tqV4lNh2+hhY9L9TxZ2oiJ
TLSH 94753354ADEF74A4235BBF1CDF91861FDC6832861D1F29C486A6B34F1007898CCBB699
Reporter abuse_ch
Tags:AveMariaRAT cab nVpn RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp.oxcardkk.club
Sending IP: 89.32.41.165
From: Elgen Trading LLC <info@oxcardkk.club>
Subject: SHEET,CS,A283-C,2000X1000MM,1.5MM,GLV
Attachment: RFQ New Order Quote.cab (contains "RFQ New Order Quote.exe")

AveMariaRAT C2:
bestsuccess.ddns.net:2442 (185.165.153.108)

Pointing to nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacyfirst.sh'

inetnum: 185.165.153.0 - 185.165.153.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-AT
country: AT
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2020-10-07T21:42:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodCab-A.3655.29186.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b995eb14128d538f1205c5f38c0adb870f0c791df6ed972454a97fd5c76db472/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 11:29:34 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgk6wfasrvjy6eqfyxzyycw3q4hqy6i563wzojcuvf75lr3nwrza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Hupigeon
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b995eb14128d538f1205c5f38c0adb870f0c791df6ed972454a97fd5c76db472

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

cab b995eb14128d538f1205c5f38c0adb870f0c791df6ed972454a97fd5c76db472

(this sample)

AveMariaRAT

Executable exe 9644b2e969c1f31621ec532efcdea76079eb9d9e64d20878fc69ec79fbc10ed4

  
Dropping
MD5 0f0e97befc3e0df47c38008e0e513213
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9644b2e969c1f31621ec532efcdea76079eb9d9e64d20878fc69ec79fbc10ed4

Comments