MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fa521f676916e485cd1a3c2c38062c84248294d9ffdcaa5674c2d73df7c1e42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fa521f676916e485cd1a3c2c38062c84248294d9ffdcaa5674c2d73df7c1e42
SHA3-384 hash: 796ac8cb480b8e43937b4fc6708861d2abe637cba36cc6e201762355da9ca02d756e851bc7306a383d0578cdba12398b
SHA1 hash: 787e577a5c28a4d1799439a5778c444c28e614fc
MD5 hash: acdbfe43f4840b7eb031173fcda1ae6b
humanhash: tennis-angel-india-mike
File name:Investment document.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:593'408 bytes
First seen:2020-08-12 15:42:00 UTC
Last seen:2020-08-12 17:00:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:XiDahgu03+l03+2LweTxLfkgdE39uibdwjJgg2u:SDaGu03+l03+2LLTxjkg6J4j9
Threatray 1'089 similar samples on MalwareBazaar
TLSH 4FC4BF6473A59823D2767E35CAB7551007BABC93753DC30E6ACD72CE98303AD5E007AA
Reporter abuse_ch
Tags:AveMariaRAT exe nVpn RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mta0.alatais.com
Sending IP: 185.181.9.109
From: Mr muphey <cont@alatas.com>
Subject: investment
Attachment: Investment document.rar (contains "Investment document.exe")

AveMariaRAT C2:
79.134.225.75:2314

Hosted on nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/44287/
Detection(s):
SecuriteInfo.com.RSharedStrings.15391.17497.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/423107
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Binary contains a suspicious time stamp
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 263993 Sample: Investment document.exe Startdate: 13/08/2020 Architecture: WINDOWS Score: 100 39 Malicious sample detected (through community Yara rule) 2->39 41 Sigma detected: Scheduled temp file as task from temp location 2->41 43 Yara detected AntiVM_3 2->43 45 11 other signatures 2->45 7 Investment document.exe 7 2->7         started        11 Investment document.exe 4 2->11         started        process3 file4 31 C:\Users\user\AppData\Local\...\tmp5CBF.tmp, XML 7->31 dropped 33 C:\Users\user\...\Investment document.exe.log, ASCII 7->33 dropped 35 C:\Users\user\AppData\Roaming\JHswPmZ.exe, PE32 7->35 dropped 47 Injects a PE file into a foreign processes 7->47 13 Investment document.exe 4 2 7->13         started        17 schtasks.exe 1 7->17         started        19 schtasks.exe 1 11->19         started        21 Investment document.exe 1 11->21         started        23 Investment document.exe 11->23         started        25 2 other processes 11->25 signatures5 process6 dnsIp7 37 79.134.225.75, 2314, 49711, 49723 FINK-TELECOM-SERVICESCH Switzerland 13->37 49 Increases the number of concurrent connection per server for Internet Explorer 13->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->51 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        signatures8 process9
Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6fa521f676916e485cd1a3c2c38062c84248294d9ffdcaa5674c2d73df7c1e42/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 15:43:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6ssd5twsfxeqxgrupbmhadczbbeqkknt764vjlhjqwxhx34dzba._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0ec0198355e571b159374277b3b719ae11a7b71409933b9a44cd15006e1f41e1
AveMariaRAT
155b9d26bbe7326b6aff0b6561ba0c3b10f3a404bbc74392bcf1fd91f3f89041
AveMariaRAT
19fa55d64a5d0900b5f8604bb765ab9196e07b2716f1248e0a8c6245e12e2119
AveMariaRAT
84bab154c87b11ac5b1a1ca6a03ddde52bc3e10aab785cefc86aed45e7bba89f
AveMariaRAT
8a75c0e55378f9dc85aa262a1133a3d7b4c37d38502ac87a8f4bea0fc273e55f
AveMariaRAT
9d3c04431db8d2630361ac69def49189101a5bf017627be2f147bcd66f3c8d29
AveMariaRAT
da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a
AveMariaRAT
e6d6cda38ec798c76fb5727c7af199c496408484c68f3d7c0d34d6be09900ca0
AveMariaRAT
ee89a8d22b1d40f75fc6d37660f3e1c3c972fdd2e21585af4de053c2a2223f21
AveMariaRAT
ff4bcfd3663088b0e8fed48b19bf950f8a6680fea9d3b0a478ac1fbfbcefeeef
AveMariaRAT
+ 1'079 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/200812-72h26eb4v6/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Program Files directory
Drops file in System32 directory
Modifies service
Suspicious use of SetThreadContext
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Modifies WinLogon
Adds Run key to start application
Modifies WinLogon
Sets DLL path for service in the registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6fa521f676916e485cd1a3c2c38062c84248294d9ffdcaa5674c2d73df7c1e42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 934bdb385f926923aab941963333bf354f5a1ce2d2dc534dd5cbe74b2e1d14d8

AveMariaRAT

Executable exe 6fa521f676916e485cd1a3c2c38062c84248294d9ffdcaa5674c2d73df7c1e42

(this sample)

  
Dropped by
MD5 6058dc47d3f43df0086de71a6379c518
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/44287/
  
Dropped by
SHA256 934bdb385f926923aab941963333bf354f5a1ce2d2dc534dd5cbe74b2e1d14d8

Comments