MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc03a70f334fe746751bd57d3a7e78e41cb77b4705c503a19c7faae20b70faa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc03a70f334fe746751bd57d3a7e78e41cb77b4705c503a19c7faae20b70faa0
SHA3-384 hash: f6165e6f2c763a74185035d8ca52065accec593b3767d88c8ac09a9467ed8d40d768c20e521a83466643cc1de7ab1d12
SHA1 hash: f3f6e3f77c77c3e97548513c9758b0a31a5f5dd1
MD5 hash: adeeec87d3f5512ecd4fb392cc0cd7f1
humanhash: oxygen-california-william-mike
File name:TwPBS.docm
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:88'744 bytes
First seen:2020-05-09 06:43:44 UTC
Last seen:Never
File type:Word file docm
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 1536:bSwYp1DP0pUnHyVPoDTQbQmZ+/ohZlgO348NgltL6v63:3YpFoU0QmZMalBoRNC63
TLSH 9683D74789059E93E468C3B8BF035AAD6F593E0CE4827AFF15121E977B713621D8E02D
Reporter abuse_ch
Tags:AveMariaRAT docm nVpn RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: ns1.mboronin.pw
Sending IP: 173.82.115.173
From: noreply@paymentportal.com
Subject: Kindly Confirm payment
Attachment: TwPBS.docm

AveMariaRAT payload URL:
http://77.73.69.137/edsd/Fksamai.exe

AveMariaRAT C2:
freenigga.ddns.net:7082 (185.140.53.18)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Downloader.mc.28516.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Mrsn
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 12:57:25 UTC
File Type:
Document
Extracted files:
21
AV detection:
6 of 48 (12.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3qb2odztj7tum5i32v6tu7ty4qolo62haxcqhim4p6voec3q7kqa._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-n2v67k7hcx/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Office loads VBA resources, possible macro or embedded object present
Blacklisted process makes network request
Process spawned unexpected child process
Malware Config
Dropper Extraction:
http://77.73.69.137/edsd/Fksamai.exe
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_alina_pos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_gootkit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Word file docm dc03a70f334fe746751bd57d3a7e78e41cb77b4705c503a19c7faae20b70faa0

(this sample)

AveMariaRAT

Executable exe e43d34170181b3e9b5baf550d70b27fdbcfcc8e974694352d77e5e52e8866a2d

  
URLhaus
https://urlhaus.abuse.ch/url/360414/
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e43d34170181b3e9b5baf550d70b27fdbcfcc8e974694352d77e5e52e8866a2d
  
Dropping
MD5 e3cf0eaf9e7653cf822f12c5a6e8cd96

Comments