MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 847a17631eb77cdb667aadc9bebec75562fd1dfc4fd6206d2ec2636a11671cca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 847a17631eb77cdb667aadc9bebec75562fd1dfc4fd6206d2ec2636a11671cca
SHA3-384 hash: 6b075b9432be0c76a2cfdfa7bc0508b4453c9cb570c082a6be7ff4e73372df279d14aab2a47d5dc7f15058a1027cf14a
SHA1 hash: fded32c568bf8bfbb4f937f6c6a23be3e4de8e3c
MD5 hash: bb5454dd5bd4348184f41b2a179fc485
humanhash: mars-vegan-oxygen-finch
File name:Invoices,Pictures jpg jpg jpg jpg.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:487'424 bytes
First seen:2020-08-18 19:17:46 UTC
Last seen:2020-08-18 20:11:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:2RyhymADSATjcwOBhxbPwLY1gst5P5Lkbm:RwJlTjVOBhxDFj15L
Threatray 743 similar samples on MalwareBazaar
TLSH A7A4E1323295DF24E1BA2336CCD9520903F9BC037512DADABDD9224C7D21F9747A26DA
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: slot0.kamaehr.com
Sending IP: 104.168.213.82
From: info@kamaehr.com
Reply-To: info@kamaehr.com
Subject: ATTACHED FILE PRODUCTS NEEDED PLEASE
Attachment: Products_Images_Designs_Log_pdf.zip (contains "Invoices,Pictures jpg jpg jpg jpg.exe")

AveMariaRAT C2:
198.12.84.39:5200

Intelligence

File Origin
# of uploads :
2
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48024/
Detection(s):
SecuriteInfo.com.Variant.Razy.361613.9221.28547.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/847a17631eb77cdb667aadc9bebec75562fd1dfc4fd6206d2ec2636a11671cca/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 10:42:49 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qr5boyy6w56nwzt2vxe35pwhkvrp2hp4j7lca3joyjrwuelhdtfa._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
00bb6fd18eb233e3b8dcd73015363ab7cef5efac776697c2126b8932ffd4d888
AveMariaRAT
0c666978e3d3fbfa2fe40db4b7de89d5e4e9d4caeacc33b54ba0311aff72a23b
AveMariaRAT
147fd6db099fd3dc5df37edc08622878edd4b048e858e8c002db3f3511d922a6
AveMariaRAT
25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e
AveMariaRAT
37d250d71a687db0e2c094fd5932bd32a6198a94b86553580d495cbb592d0f96
AveMariaRAT
996ede8d9cb8561481707de2768ca29bf7294c66ac1de666cb390417eb2d9d60
AveMariaRAT
b012e1f25d3642b743bab2be52eea91dccda4b34709bde39ab802247c0212af7
AveMariaRAT
be66827292b98575cb69b0898954699f52c491ddb0bc8c613a70d20fb3871657
AveMariaRAT
d045c6b114f25c29811bbb61864da2f464c9d5195b54d70008b7bbf91384b47f
AveMariaRAT
de25f269f4f7e5cc02f5e16e0c780ef25787df1d161f2fad276d88ddfce79f90
AveMariaRAT
+ 733 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence spyware
Link:
https://tria.ge/reports/200818-7wntyhxb3j/
Behaviour
Creates scheduled task(s)
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Program Files directory
Drops file in System32 directory
Modifies service
Suspicious use of SetThreadContext
Drops file in System32 directory
Modifies service
Suspicious use of SetThreadContext
JavaScript code in executable
Maps connected drives based on registry
Modifies WinLogon
JavaScript code in executable
Maps connected drives based on registry
Modifies WinLogon
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Sets DLL path for service in the registry
Looks for VMWare Tools registry key
Sets DLL path for service in the registry
Looks for VirtualBox Guest Additions in registry
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/847a17631eb77cdb667aadc9bebec75562fd1dfc4fd6206d2ec2636a11671cca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 58bbda497419849bd851ed97dfde285b9c995a4421af98475776d6879e21309d

AveMariaRAT

Executable exe 847a17631eb77cdb667aadc9bebec75562fd1dfc4fd6206d2ec2636a11671cca

(this sample)

  
Dropped by
MD5 11e598ad2fd776265951dc0720d55273
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/48024/

Comments