MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4476eb7793d7a51f41e259613431aa34ed5a74ec688d5937276703ecb0ac76d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 7 File information Comments

SHA256 hash:	e4476eb7793d7a51f41e259613431aa34ed5a74ec688d5937276703ecb0ac76d
SHA3-384 hash:	7aa8a5c41e1f248f14ff03048831b7b2451b413f63569c4eb0b463e91f12b0ec8ce69c403b10b5e45c51c975096005e5
SHA1 hash:	4439e030558b30cdc41b337111d5e386d02f741a
MD5 hash:	0199fdcdc7d9b9ad4b9b8711c55d72db
humanhash:	beryllium-pizza-lion-carolina
File name:	PO#441KJ.pdf.exe
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	348'672 bytes
First seen:	2020-06-09 05:57:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:b/2EexTCFZKw8EUMrP0zM3I0/ey2ZQumkFqiFjb+lDAA:bezeXK7ETrPn3I99mkFqiFjidAA
Threatray	488 similar samples on MalwareBazaar
TLSH	0E7429E0B740C06DD8578935843ABDA364337A9E8DD9851D2992BF4FFE7A343491388B
Reporter	abuse_ch
Tags:	AveMariaRAT exe RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: serve0.sanyuktaguptea.pw
Sending IP: 173.82.245.119
From: Purchase <hr@sanyuktaguptea.pw>
Subject: RFQ-PO 442KJ
Attachment: PO442KJ.pdf.z (contains "PO#441KJ.pdf.exe")

AveMariaRAT C2:
logz.duckdns.org:1738 (188.215.229.95)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.LuheFihaA.32569.7108.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Ransomware.Gendarmerie

Status:

Malicious

First seen:

2020-06-09 00:56:41 UTC

AV detection:

32 of 48 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4rdw5n3zhv5fd5a6ewlbgqy2unhnlj2oy2enle3sozyd5syky5wq._file

Verdict:

malicious

Label(s):

avemaria

AveMariaRAT

244e2f212245708bd757b50107c8d221e842a683c258f16b744be653fde53c73

AveMariaRAT

331f79d447c67aba1c4c7c9453adf79eb9c631219720e5fbcc051af167dff87d

AveMariaRAT

54519fe3bb2beec228d65ef66bb64cb19beb8bd0f6cc7d973b69137950f5bc6f

AveMariaRAT

5f9d0a3f1053e6159f628438ac08f66063ad443e44dcbb12dfaf0edbc06ba96b

AveMariaRAT

8ad9862548bf4d19b6e8efc18a0a54a359cc4f11a7f4bfac1a3029b853fa6e0e

AveMariaRAT

9188298a545444368a26d4d1fcc9be1e49ed55660891458d75c3dd5a2981c93b

AveMariaRAT

b63fb85445e2ca71dcfd034c927fda1ac593cdd2f229f4f785e93e4bec712521

AveMariaRAT

c72cde3224e01da2283065c5a94d252f528c132019eb2f2656c86a7caa1006c2

AveMariaRAT

d015c42aeec1560eb2cf33b77fab18293a23cf61a7621746bc923a9ad4cc64dd

AveMariaRAT

+ 478 additional samples on MalwareBazaar

Result

Malware family:

warzonerat

Score:

10/10

Tags:

family:warzonerat infostealer rat rezer0

Link:

https://tria.ge/reports/201109-a7deyx95zj/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Warzone RAT Payload

rezer0

WarzoneRat, AveMaria

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	win_ave_maria_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_malumpos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com