MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 950c5135a82ae668688c83c699fc372e74f2745aae8effd9f87fcae2b4a447be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 950c5135a82ae668688c83c699fc372e74f2745aae8effd9f87fcae2b4a447be
SHA3-384 hash: 28ade785fd3f7b1a5685fe7d6ad0f902b11a179d8f590440c439c398b0959ba2104062a9bf0a9e868c8172736dd80f30
SHA1 hash: 23d9fe292633e8b8aa9aa8a9f36a4d8a91964797
MD5 hash: 26366efb1fa46b24b16cce10214772e8
humanhash: washington-texas-pennsylvania-fish
File name:950c5135a82ae668688c83c699fc372e74f2745aae8effd9f87fcae2b4a447be
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'856'573 bytes
First seen:2020-06-29 07:11:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7be4c98eebb39d282cdffc1cea8fb470 (661 x AveMariaRAT, 29 x Riskware.Generic)
ssdeep 12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgG:X1gg4CppEI6GGfWDkCQDbGV6eH81kJ
Threatray 771 similar samples on MalwareBazaar
TLSH D2857CE2B3654027D2232B767C0FC660A949BE6E5750A75F2BF63D0C8EB7681B453243
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15490/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Daqc-6598201-0
Create hunting rule

Win.Malware.Ursu-6793772-0
Create hunting rule

Win.Malware.Ursu-6914171-0
Create hunting rule

Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/950c5135a82ae668688c83c699fc372e74f2745aae8effd9f87fcae2b4a447be/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-06-21 23:51:59 UTC
File Type:
PE (Exe)
Extracted files:
63
AV detection:
27 of 29 (93.10%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
0d803d4ab4cc06e12ba51d6af2a2c5d4b6a2d0c38bd766972e2d7b96a10372e2
AveMariaRAT
13b83d53dac5f16112976a519447204a8543d66294a85ef16810dc3cbb19ef7d
AveMariaRAT
466ae06e8e6f0afe293784a3d657ae73469aa0be65cd740f6b6e0b4f56039fd7
AveMariaRAT
54c9ce578a123b2abbcb00af7638f3d1c93041959ebccf3981a099a869c5a171
AveMariaRAT
753e45a48d86d4832c4cfe09e5c5dc18342aae8dde9a2a1851434aa1467da4b9
AveMariaRAT
7ab6a057395d00f0f894c3825e82fe743f1bf1ace1a7c00da1e484b8c1d00648
AveMariaRAT
7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444
AveMariaRAT
80f261e0af58da2e11d1ce255795fe9eb839be94248e118e6777483894a5eb67
AveMariaRAT
99a98bc6f2caf5e6fe3e6ada1af35586392ea48a28bc601522bed98454cc6af6
AveMariaRAT
fc43a119f255e01cc5bd1ae95791495a4f92cc0545d64b0bdab72dc126a5dd4e
AveMariaRAT
+ 761 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/200629-3jaxgfs58n/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run entry to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15490/

Comments