MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ef93b76b923b5e541eab0060d613166f92d4571dc5fede5109fc501bd78b050. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ef93b76b923b5e541eab0060d613166f92d4571dc5fede5109fc501bd78b050
SHA3-384 hash: eac8c3d886b1fb84fcb878f3436725be2476cadc6304a16cac74adc9b7261372692a1cf3dd8d992afc7d1bfab48ed4fa
SHA1 hash: 4c7c0c70a74b940e9cd6a262c3313bc88c2c2645
MD5 hash: 0d8c860108ca1666dd20e743d151bfd5
humanhash: cardinal-chicken-johnny-jupiter
File name:5ef93b76b923b5e541eab0060d613166f92d4571dc5fede5109fc501bd78b050
Download: download sample
File size:6'422'918 bytes
First seen:2020-06-16 09:24:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 676f4bc1db7fb9f072b157186a10179e (1'400 x AveMariaRAT, 37 x Riskware.Generic, 2 x njrat)
ssdeep 49152:ATU7AAmw4gxeOw46fUbNecCCFbNecFTU7AAmw4gxeOw46fUbNecCCFbNecl:ATU7d9xZw46G8q8mTU7d9xZw46G8q8o
Threatray 1'486 similar samples on MalwareBazaar
TLSH 3756AF93BD7E481AF732D871C08FAA5163E4792AA300E71B7F7AFC9190635D7C169602
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10668/
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Ursu-6793772-0
Create hunting rule

Win.Malware.Ursu-6914170-0
Create hunting rule

Win.Malware.Ursu-6914171-0
Create hunting rule

Win.Malware.Cerber-6989221-0
Create hunting rule

Gathering data
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-06-13 00:39:44 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
44 of 48 (91.67%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
20232a6aa0611a2a174fedae02b41b42e6125de3dcb443e5123ac7af0f3c33fb
2cbfb5b5238c10c431fa755298761b8800c34ee953d3e1363e6c61c53830ebcc
38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837
55461b9a911c4a9fb7de66db5a891b859755f5cab7cde452c2e43f68822fda5a
5cb853a95efb63587a4a7565020f6f36a9f7bf6fd2746c5795a06d49b245a666
62d78395696e2c85de61f3bae5cd895eb3919e41ba7e18b6381886280f26efbf
6e0c57860fd63458bbcd929909d9001354d8ff470c66734cba7eaec86c00d446
a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e
a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435
bd52404743f2914218a89eb081442ab810148fc27b95f799036d5d6767a3f5db
+ 1'476 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/200624-c8xjcxayqj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Loads dropped DLL
Drops startup file
Executes dropped EXE
Modifies Installed Components in the registry
Modifies the visibility of hidden or system files
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10668/

Comments