MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02e038ab4393164f91b8dc9bf2e09ddccde0f4dfef9aac731767b241d4fea47c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02e038ab4393164f91b8dc9bf2e09ddccde0f4dfef9aac731767b241d4fea47c
SHA3-384 hash: 8a7c90d426c52c2ba1d8fd988eda82d06acd82bf7da3d0c678cb4f0f1b0e15e3d1970db35e9a6f5050e6e01f7f65dd82
SHA1 hash: 0b4aeaf7f83b7fa9d467126397fb864954be0b8e
MD5 hash: b490e1c3a363d84178347203f4a39b20
humanhash: wisconsin-eleven-paris-kilo
File name:DHL발송서류- 20180904153201117119330^^PDF.scr
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'074'688 bytes
First seen:2022-02-24 07:46:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:o88wUt8KzKSaQdLLn5LByK1adBkR/79MSQZ2RfuXr:qPtZaQ3PyDdCR79MSe2RGXr
Threatray 2'245 similar samples on MalwareBazaar
TLSH T18D35232E9AD30DC4E6BC24FD39B58A60CAC795603E72131632A7F055C93BB136B4D6C9
File icon (PE):PE icon
dhash icon c88cc8c8982850f8 (18 x AgentTesla, 16 x AveMariaRAT, 1 x RedLineStealer)
Reporter abuse_ch
Tags:AveMariaRAT DHL exe scr

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RDPWrap
Create hunting rule
Link:
https://www.capesandbox.com/analysis/244121/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/621737fba6f52d32f17eb194/reports/da1a1c4b-1ccf-4fa1-9d0e-5bf487487564/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7a3a5c0d-fd4b-47cf-a2a3-64b700d06298
Result
Threat name:
AveMaria gzRat
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/945449
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Obfuscated command line found
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Yara detected AveMaria stealer
Yara detected Costura Assembly Loader
Yara detected gzRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 577926 Sample: DHL#Ubc1c#Uc1a1#Uc11c#Ub958... Startdate: 24/02/2022 Architecture: WINDOWS Score: 100 72 Found malware configuration 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 Antivirus / Scanner detection for submitted sample 2->76 78 9 other signatures 2->78 7 DHL#Ubc1c#Uc1a1#Uc11c#Ub958- 20180904153201117119330^^PDF.exe 16 7 2->7         started        12 Abmkm.exe 14 3 2->12         started        14 Abmkm.exe 3 2->14         started        process3 dnsIp4 50 filetransfer.io 188.114.97.7, 443, 49753, 49754 CLOUDFLARENETUS European Union 7->50 52 192.168.2.1 unknown unknown 7->52 54 s26.filetransfer.io 7->54 42 C:\Users\user\AppData\Roaming\...\Abmkm.exe, PE32 7->42 dropped 44 C:\Users\user\...\Abmkm.exe:Zone.Identifier, ASCII 7->44 dropped 46 DHL#Ubc1c#Uc1a1#Uc...119330^^PDF.exe.log, ASCII 7->46 dropped 80 Writes to foreign memory regions 7->80 82 Injects a PE file into a foreign processes 7->82 16 RegAsm.exe 7->16         started        19 RegAsm.exe 3 2 7->19         started        22 cmd.exe 1 7->22         started        24 RegAsm.exe 7->24         started        56 188.114.96.7, 443, 49800, 49801 CLOUDFLARENETUS European Union 12->56 58 s26.filetransfer.io 12->58 84 Antivirus detection for dropped file 12->84 86 Multi AV Scanner detection for dropped file 12->86 88 Machine Learning detection for dropped file 12->88 26 cmd.exe 1 12->26         started        60 s26.filetransfer.io 14->60 28 cmd.exe 14->28         started        file5 signatures6 process7 dnsIp8 62 Contains functionality to inject threads in other processes 16->62 64 Contains functionality to steal Chrome passwords or cookies 16->64 66 Contains functionality to steal e-mail passwords 16->66 48 45.162.228.171, 26112 QNAXLTDABR Brazil 19->48 68 Increases the number of concurrent connection per server for Internet Explorer 19->68 70 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->70 30 conhost.exe 22->30         started        32 timeout.exe 1 22->32         started        34 conhost.exe 26->34         started        36 timeout.exe 1 26->36         started        38 conhost.exe 28->38         started        40 timeout.exe 28->40         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02e038ab4393164f91b8dc9bf2e09ddccde0f4dfef9aac731767b241d4fea47c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-24 07:47:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=alqdrk2dsmle7eny3sn7fye53tg6b5g756nky4yxm6zedvh6ur6a._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0741c36ad10f51f858eefc2e2f0879c9ef1ae90af61d766bd50ebcc67f4d5579
AveMariaRAT
1315fb9110a9b6bcf1326af2be8438b1d47bc4b46815db1ab49bed4fa58b3f51
AveMariaRAT
213d220d21939cba114f6afcc4bc672d28bb416075db96a81635f22dccfdc829
AveMariaRAT
489a2e9c82e83a219e62ded379b4dd8323be026889a3453bc97f0cca67a8828d
AveMariaRAT
649acc4a8ec45c2b3d6e217e3818db8174eb3a3bd923d8b907f6164fd42bb751
AveMariaRAT
6c50f2ce4c1837beeeae5f03ae740dc759955eabb63ef41bda72bc89312657c8
AveMariaRAT
c7b9caa8ed91068cdc627c8e72f9ecb6f71d4c99b16e930d4875bc283bb25529
AveMariaRAT
e961ac85380ccd346de98c4a55e10b837b9a77b7d31ec7a312b61b484e32c932
AveMariaRAT
+ 2'235 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer persistence rat
Link:
https://tria.ge/reports/220224-jmlzaadegn/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Suspicious use of NtCreateProcessExOtherParentProcess
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
45.162.228.171:26112
Unpacked files
SH256 hash:
02e038ab4393164f91b8dc9bf2e09ddccde0f4dfef9aac731767b241d4fea47c
MD5 hash:
b490e1c3a363d84178347203f4a39b20
SHA1 hash:
0b4aeaf7f83b7fa9d467126397fb864954be0b8e
Link:
https://www.unpac.me/results/7529a5ee-8ed0-40de-b33c-6813a8b3f7cb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/02e038ab4393164f91b8dc9bf2e09ddccde0f4dfef9aac731767b241d4fea47c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/244121/

Comments