MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8744a3ac642e71bfd57f1476bb54d94aee2d6f80ad4b41548931685debec08e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 3

Intelligence 3 IOCs YARA 10 File information Comments

SHA256 hash:	a8744a3ac642e71bfd57f1476bb54d94aee2d6f80ad4b41548931685debec08e
SHA3-384 hash:	8da1678df78dadd0d9679310ce04d9f04cc555663b962d2d2a207dc61b7c141adcefd4be5377497e394c44437ae262b9
SHA1 hash:	99c381c8909caf54c2daba0cc3a3724f4cadfe8c
MD5 hash:	5c7b2174792679ffe2ae09dd23e27474
humanhash:	steak-bulldog-butter-iowa
File name:	Payment_Details.exe
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	228'864 bytes
First seen:	2020-05-24 07:29:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:jfqowCWxrZvjduvkkt+tnSRNnT5UYQvN/7ay2Qo:jfqob+ZvJ++tnMNnT5zQvN/Oy
Threatray	652 similar samples on MalwareBazaar
TLSH	7A24D02C3A8C5637C66D0A747091100213F64D6A7A93F3C9FD9DF6AB22B63DC0525AE3
Reporter	abuse_ch
Tags:	AveMariaRAT Chase exe RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: slot0.syspostal.pw
Sending IP: 192.119.106.124
From: Chase Bank <postmaster@syspostal.pw>
Subject: Funds has bee Transfered
Attachment: Payment_Details.img (contains "Payment_Details.exe")

AveMariaRAT dropping NanoCore RAT

NanoCore RAT payload URL:
http://mysipro.com/sysaudio.exe

AveMariaRAT C2:
51.89.204.165:52001

NanoCore RAT C2:
216.170.119.19:24980

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Agensla

Status:

Malicious

First seen:

2020-05-23 20:05:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 30 (66.67%)

Threat level:

2/5

Verdict:

unknown

AveMariaRAT

3146e047d6021c93280619fc4b62a7bc945d70cd21163c05fad4e0048ce5d505

AveMariaRAT

4cce78237c2dd903e6f277f50753aeb2f63e1f856722b5a379a81e306af3ae71

AveMariaRAT

644a0403a3c8254a3846b8c07aa7fdeb2cfe21aa5630ca3100949869f60ae407

AveMariaRAT

65310d8eb88574b37c3d5715c6eee910f2549099b512deb0ba9403c290f16340

AveMariaRAT

b977389b487ea178bc1ce4448a2a67c5f0a5d327a6c9500308574aa9945901df

AveMariaRAT

c8f6c9f25558e561f9d510ffcfe8f81a2d701afc0ed3bb3ae2bb0435feb0fc9e

AveMariaRAT

d264b0408012a14c3c10a28e37f7e1dc11ef6d0c0d801913ed03afa118533032

AveMariaRAT

da049203324396b99402d08997483bf22631b61d6b272d9bbe0a7ea35b55e40c

AveMariaRAT

fc44a6e861843ed0dca54174a5257b83c1e883eeecb13bd841f779c0aede0626

AveMariaRAT

+ 642 additional samples on MalwareBazaar

Result

Malware family:

warzonerat

Score:

10/10

Tags:

family:warzonerat infostealer persistence rat

Link:

https://tria.ge/reports/201109-x3667as9cn/

Behaviour

NTFS ADS

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Drops startup file

Loads dropped DLL

Executes dropped EXE

Warzone RAT Payload

ServiceHost packer

WarzoneRat, AveMaria

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Rule name:	win_ave_maria_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator