MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c51058733acbdfdb2281a3278a4fc05df65e823ed324033eef981e940db4dcf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c51058733acbdfdb2281a3278a4fc05df65e823ed324033eef981e940db4dcf4
SHA3-384 hash: 7dc7d7beeff0910fa0959eddcbc048ec8a6026fb10c0ae2eb01459018ecccd6885e048cc088926c74d14ffc36e67ec86
SHA1 hash: e246abb30794bda96e347d7eaeb4c1c46dd7d57d
MD5 hash: 2d47e712019aa4a266acd4c5ed52289d
humanhash: asparagus-magazine-thirteen-juliet
File name:ORDERPROCURE20206.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:638'464 bytes
First seen:2020-06-04 17:50:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 13bda32eb13d3eb49bc287f44d7db8e9 (3 x RemcosRAT, 1 x AveMariaRAT)
ssdeep 6144:drVWTPtdNikCddIwVszNQM/ck4YvntuwJD8gxOeOMUkH+xZX+jI5M7IrYd2t/uuy:BVWPt5IIwVs1v9PUk+niUrYkjV3b
Threatray 436 similar samples on MalwareBazaar
TLSH 96D48D62B7A24477D133077D8C1BCE78643BBD156E78684B2AEA7C4C9F36282352B147
Reporter abuse_ch
Tags:AveMariaRAT exe nVpn RAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: bosmailout03.eigbox.net
Sending IP: 66.96.189.3
From: Khan Industries <admin@zbindustry-com.tk>
Reply-To: exportscoin@gmail.com
Subject: Re: procurement NO 5678 2020
Attachment: ZTECHORDERPROCUREMENT2020.06.IMG (contains "ORDERPROCURE20206.exe")

Unknown RAT C2:
79.134.225.43:5908

Hosted on nVpn:

% Information related to '79.134.225.0 - 79.134.225.63'

% Abuse contact for '79.134.225.0 - 79.134.225.63' is 'abuse@anmaxx.net'

inetnum: 79.134.225.0 - 79.134.225.63
netname: BASEL-HOSTING-225-0
country: CH
admin-c: AM38880-RIPE
tech-c: AM38880-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
created: 2016-04-17T00:42:52Z
last-modified: 2016-04-18T06:23:19Z
source: RIPE
remarks: abuse-c AIS166-RIPE
org: ORG-AGIS12-RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 17:54:25 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yuifq4z2zpp5wiubumtyut6alx3f5ar62msagpxptapjidnu3t2a._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
00b9b4052ac7c4ace332225ed5e198de938c10534f6baee1d28acfc34c5a292e
AveMariaRAT
1b13660c52adcccc1cef45f137a3373f5615500a609c61a9872e5ed4336e629a
AveMariaRAT
2248af8172666d8874da1df1fc121c29520571361c6aab67e9b156c072531d90
AveMariaRAT
331f79d447c67aba1c4c7c9453adf79eb9c631219720e5fbcc051af167dff87d
AveMariaRAT
40503a4df817599fdf0125c5b99076700718e3eb50bbb759d139aa95a8d18d59
AveMariaRAT
5f9d0a3f1053e6159f628438ac08f66063ad443e44dcbb12dfaf0edbc06ba96b
AveMariaRAT
b1d390b1639ffe648b693d603f9a8fa18edf2deb730e315c3f80fa0e4949885f
AveMariaRAT
b5b64f85cdeb5432018e22087fce4b6dc1e56593e8416335f471d4eac1e2b8cf
AveMariaRAT
c72cde3224e01da2283065c5a94d252f528c132019eb2f2656c86a7caa1006c2
AveMariaRAT
daa781c0d56eb6b5aadb71ae3136474eaf87f474f5e98f16fa977b692cb349af
AveMariaRAT
+ 426 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader
Link:
https://tria.ge/reports/201109-5z836bjpvj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

img 2bc9aeacdb68f02548af3cbcf26035cfe312ed7084716390a9baf1e6f37583bc

AveMariaRAT

Executable exe c51058733acbdfdb2281a3278a4fc05df65e823ed324033eef981e940db4dcf4

(this sample)

  
Dropped by
MD5 6d759908222a168230286f5f8ff1d418
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 2bc9aeacdb68f02548af3cbcf26035cfe312ed7084716390a9baf1e6f37583bc

Comments