MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9b7e03baedfc5758b2a5e0716e4178927ef96a662e4f566c748779d1550dffd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9b7e03baedfc5758b2a5e0716e4178927ef96a662e4f566c748779d1550dffd
SHA3-384 hash: ceb3058fa9da88eb5fcc68822c758a77b38a16229da035af504a552acc06d35b44490ab29fd470fae482555cc18f3156
SHA1 hash: 09d18cf64a34af16c34434532c3e844d0a4af7ab
MD5 hash: 8d413a8d770c2afc2d051365d8284d2f
humanhash: indigo-mountain-victor-alanine
File name:SÄ°PARÄ°Åž.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:52'640 bytes
First seen:2020-10-23 13:52:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:6xdwcTIYWOta2iwsELpOzMhIVLURNqbYJuEN:6/w8bWOtarrEJIwNqk4EN
TLSH 353302D20421209BFDE7171D0ADBC1D7D763E68EE2076EEA12249B647C9C6939B4F01B
Reporter abuse_ch
Tags:AveMariaRAT nVpn rar RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: voax-001.grupoalonso.com.mx
Sending IP: 162.255.85.212
From: gokhan <gokhan@obapaslanmaz.com>
Subject: SİPARİŞ
Attachment: SÄ°PARÄ°Åž.rar (contains "SÄ°PARÄ°Åž.exe")

AveMariaRAT C2:
morggy11.ooguy.com:5194 (185.244.30.138)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9b7e03baedfc5758b2a5e0716e4178927ef96a662e4f566c748779d1550dffd/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 13:24:37 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zg36ao5o37cxlczklydrnzaxret67fvgmlspkzwhjb3z2fkq376q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9b7e03baedfc5758b2a5e0716e4178927ef96a662e4f566c748779d1550dffd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar c9b7e03baedfc5758b2a5e0716e4178927ef96a662e4f566c748779d1550dffd

(this sample)

AveMariaRAT

Executable exe 62c4557e27a25fcfb7eefbb8abd533117c31ae4687b96d1aaa8ceff082db63c2

  
Dropping
MD5 9778b56a856975cec50b3160fb960941
  
Dropping
AveMariaRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 62c4557e27a25fcfb7eefbb8abd533117c31ae4687b96d1aaa8ceff082db63c2

Comments