MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3785c1c5566cb064532d7573da4d6dc466977ba524ea961b275edfc7eb5cc925. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3785c1c5566cb064532d7573da4d6dc466977ba524ea961b275edfc7eb5cc925
SHA3-384 hash: 9ac0a970c8eb75a3bd8037d1c1615c09fb0e56055158743d10faf0433a134eb5e7038ce0af56374d548680e73bd86c24
SHA1 hash: f0f00f55f7a05d99a4b63cc32df7e694a55a91fe
MD5 hash: 41be7bff1067ccceecdab9850b54fd5e
humanhash: hamper-fish-juliet-edward
File name:New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:462'848 bytes
First seen:2020-08-06 06:35:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:UHsPOxYDghQCgOREprjVulMQZ48ZNRZ8+x8/tNGGpiDmrKXJShOANslySWbnvB:UNkg/X9lZZ5Yt1NTiDvJqOQAySWr
Threatray 443 similar samples on MalwareBazaar
TLSH C0A4C0003B949A03C7398F7B4A61516146B1EE1E6E22E29B7FC4329F587E7F80511BE7
Reporter abuse_ch
Tags:AveMariaRAT exe geo KOR RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mail-smail-vm41.hanmail.net
Sending IP: 203.133.180.229
From: 천사 <hylee30802@daum.net>
Subject: 새로운 구매 주수/샘플 및 사양
Attachment: New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.7z (contains "New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.exe")

AveMariaRAT C2:
54369253290033.sytes.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/40159/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Launching cmd.exe command interpreter
DNS request
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/412268
Signature
Allocates memory in foreign processes
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 258384 Sample: New-PO-9576578-CH-001_Order... Startdate: 06/08/2020 Architecture: WINDOWS Score: 100 38 54369253290033.sytes.net 2->38 44 Malicious sample detected (through community Yara rule) 2->44 46 Sigma detected: Scheduled temp file as task from temp location 2->46 48 Yara detected AntiVM_3 2->48 50 7 other signatures 2->50 9 New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.exe 7 2->9         started        signatures3 process4 file5 30 C:\Users\user\AppData\RoamingiCnRh.exe, PE32 9->30 dropped 32 C:\Users\user\...iCnRh.exe:Zone.Identifier, ASCII 9->32 dropped 34 C:\Users\user\AppData\Local\...\tmpD02B.tmp, XML 9->34 dropped 36 New-PO-9576578-CH-...otaion,xlxs.exe.log, ASCII 9->36 dropped 52 Contains functionality to inject threads in other processes 9->52 54 Contains functionality to steal Chrome passwords or cookies 9->54 56 Contains functionality to steal e-mail passwords 9->56 58 Injects a PE file into a foreign processes 9->58 13 New-PO-9576578-CH-001_Order_Sample_Quotaion,xlxs.exe 3 2 9->13         started        17 schtasks.exe 1 9->17         started        signatures6 process7 dnsIp8 42 54369253290033.sytes.net 13->42 60 Writes to foreign memory regions 13->60 62 Allocates memory in foreign processes 13->62 64 Increases the number of concurrent connection per server for Internet Explorer 13->64 66 2 other signatures 13->66 19 powershell.exe 25 13->19         started        22 cmd.exe 1 13->22         started        24 conhost.exe 17->24         started        signatures9 process10 dnsIp11 40 192.168.2.1 unknown unknown 19->40 26 conhost.exe 19->26         started        28 conhost.exe 22->28         started        process12
Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3785c1c5566cb064532d7573da4d6dc466977ba524ea961b275edfc7eb5cc925/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 04:32:11 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6c4drkwnsygiuznovz5utlnyrtjo65fetvjmgzhl3p4p224zesq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
02b9bc3c8ac2cea4764860f49e6be78b8fad956c7bbf28d4260671bb5260568d
AveMariaRAT
19fa55d64a5d0900b5f8604bb765ab9196e07b2716f1248e0a8c6245e12e2119
AveMariaRAT
3bc725935a192a83fe0f384f51d963b4b6c7921c3550b3c5295d3f3ca4676cd6
AveMariaRAT
433d26c66e7c158b84024a6ee83ad8145598d238ed8855a21a77b8324715c9d8
AveMariaRAT
6142ce64bdf7d4373dedcadb54fb06efed10595a65713783f2930eb1ebb9f989
AveMariaRAT
8137453fed9c0a1397eca9dd59e64141fffbd6cabf760d420adf44d4a049e40a
AveMariaRAT
84b4040d764a758414d6e7d913161c97846e563eb18e3497f207670f9d239bc8
AveMariaRAT
8bcdcd3db1dd3688101b18e4c090194ce7ac4e96ef206e56d5595e467cf25e46
AveMariaRAT
9d71c01a2e63e041ca58886eba792d3fc0c0064198d225f2f0e2e70c6222365c
AveMariaRAT
d7a9047d6d19050866c5b5c7d08f4b45208d9b2a2a4f4179cadaf37ea92cfa89
AveMariaRAT
+ 433 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/200806-g63mrv428e/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
ServiceHost packer
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/3785c1c5566cb064532d7573da4d6dc466977ba524ea961b275edfc7eb5cc925

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

7z d7053ae46b5f20e512a5af04791caad3a8d1c9e1197e7284b227b0ed32a935d9

AveMariaRAT

Executable exe 3785c1c5566cb064532d7573da4d6dc466977ba524ea961b275edfc7eb5cc925

(this sample)

  
Dropped by
MD5 d2ce894781b993628b9df52040b21553
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/40159/
  
Dropped by
SHA256 d7053ae46b5f20e512a5af04791caad3a8d1c9e1197e7284b227b0ed32a935d9

Comments