MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d348cc1e5839064e0c39702683a80185d94991e17a6fa1ad52cee80726d01cb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	d348cc1e5839064e0c39702683a80185d94991e17a6fa1ad52cee80726d01cb4
SHA3-384 hash:	ca4fcd8c5e6d6b952ea730dd53e146a6a3b42097ccd4e4ee2b14b2a0118c44cd2fdbc0fed085915532a747cf63656936
SHA1 hash:	dde964d209a4e91136e162fc82a38ec663133e4f
MD5 hash:	02b13bbaa3730e604a74604c7932eced
humanhash:	hydrogen-social-wolfram-crazy
File name:	Leaked sex Tape MT Govt -copy- JPEG.uu
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	215'371 bytes
First seen:	2021-01-14 18:58:17 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:lMi5OS9hVyefYQBLJoP9bLWNfOE9LUOVugUCUUv:lRMQFJK93LWbusv
TLSH	34242359917E6386A76C8E36153812D1C1308A273CBC66DDF240BB32B92DCA7FC5648E
Reporter	abuse_ch
Tags:	AveMariaRAT ESP geo nVpn RAT uu

abuse_ch

Malspam distributing AveMariaRAT:

HELO: smtp.aonbd.net
Sending IP: 117.58.240.41
From: info <enquiry@sgiwiring.com>
Reply-To: marie.christine.fray.paclp@gmail.com
Subject: Video sexual filtrado Oficial del gobierno de UY
Attachment: Leaked sex Tape MT Govt -copy- JPEG.uu (contains "Leaked sex Tape MT Govt -copy- JPEG.exe")

AveMariaRAT C2:
dompe.awsmppl.com:4050 (91.193.75.212)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@privacyfirst.sh'

inetnum: 91.193.75.0 - 91.193.75.255
descr: Moscow, Russia
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-RU2
country: RU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
abuse-c: ACRO34258-RIPE
mnt-by: PRIVACYFIRST-MNT
mnt-by: RIPE-NCC-END-MNT
org: ORG-KHd1-RIPE
status: ASSIGNED PI
created: 2012-06-04T11:05:55Z
last-modified: 2021-01-03T20:17:23Z
source: RIPE
sponsoring-org: ORG-MW1-RIPE