MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9
SHA3-384 hash: c75572a84c2e0415b5e4512055655fe6b62b8adca098833af73c0f40fd6df1895c5206178316c65e8a13062272b9829f
SHA1 hash: 43d9902d2a7b0583be43ef8d4023c81e9a776e52
MD5 hash: c3d2671ab969fd347e6e0b81c777fc48
humanhash: mississippi-emma-lactose-seven
File name:Reservation.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:208'028 bytes
First seen:2023-08-02 12:11:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:/Ya66WOW6k4nLUfQzcGg6Zwaidc8J1CQC:/YgWOE4EQIhairI
Threatray 563 similar samples on MalwareBazaar
TLSH T14C1402913BF4C433DC820B313EBA0657AEF5E91538A2BB0F5365191CB972A52D25E723
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c8484a4c5c5a0088 (1 x RemcosRAT, 1 x AveMariaRAT, 1 x NanoCore)
Reporter pr0xylife
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
314
Origin country :
US US
Vendor Threat Intelligence
Malware family:
avemaria
Create hunting rule
ID:
1
File name:
Reservation.exe
Verdict:
Malicious activity
Analysis date:
2023-08-02 12:14:08 UTC
Tags:
warzone rat stealer avemaria arkei
Link:
https://app.any.run/tasks/01afdb32-3286-4833-a3ab-3f5eb73a2402

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/439844/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Restart of the analyzed sample
Сreating synchronization primitives
DNS request
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/64ca4811539838c2be51db21/reports/321b0f87-03a3-461b-a6c6-570a581c4b4e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AVE_MARIA
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2e92c226-8b1f-4a54-a5c2-453ae879edf5
Result
Threat name:
AveMaria, UACMe
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1284395
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to check if Internet connection is working
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found evasive API chain checking for user administrative privileges
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected AveMaria stealer
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1284395 Sample: Reservation.exe Startdate: 02/08/2023 Architecture: WINDOWS Score: 100 32 Snort IDS alert for network traffic 2->32 34 Multi AV Scanner detection for domain / URL 2->34 36 Found malware configuration 2->36 38 8 other signatures 2->38 6 Reservation.exe 1 20 2->6         started        10 Acrobat.exe 18 2->10         started        12 Acrobat.exe 18 2->12         started        process3 file4 22 C:\Users\user\AppData\Roaming\...\Acrobat.exe, PE32 6->22 dropped 24 C:\Users\user\AppData\...\jxsmdidxxm.dll, PE32 6->24 dropped 40 Detected unpacking (changes PE section rights) 6->40 42 Detected unpacking (overwrites its own PE header) 6->42 44 Contains functionality to check if Internet connection is working 6->44 54 3 other signatures 6->54 14 Reservation.exe 3 5 6->14         started        26 C:\Users\user\AppData\...\jxsmdidxxm.dll, PE32 10->26 dropped 46 Multi AV Scanner detection for dropped file 10->46 48 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 10->48 50 Contains functionality to inject threads in other processes 10->50 18 Acrobat.exe 5 10->18         started        28 C:\Users\user\AppData\...\jxsmdidxxm.dll, PE32 12->28 dropped 52 Maps a DLL or memory area into another process 12->52 20 Acrobat.exe 1 12->20         started        signatures5 process6 dnsIp7 30 plazzasecretballeronline.onedumb.com 212.193.30.230, 14977, 49690, 49710 SPD-NETTR Russian Federation 14->30 56 Increases the number of concurrent connection per server for Internet Explorer 14->56 58 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->58 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2023-08-02 12:12:04 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
22 of 24 (91.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=alxzsk42lb6gzxbyfgk3lxh76a3hkvhmlang7iunbddqirhz4dmq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0aca752cc745390a98eed1ed64283911f5d82f4036ded947987987bcdd4243e4
AveMariaRAT
38af759cbc6513d04d12de480a4554bc4b1ac50124b8a7c0174e22b7ea1ec2ae
AveMariaRAT
5e777ea6208a9e3819ce079fca5d8ad1d8f818b20de8cda1f6c2fa867e17aac9
AveMariaRAT
808bb32f710ae23d2a4b53b873f766bf56d905dbe8e51810edd15ff79538cd94
AveMariaRAT
9b1cd01f7d8e52a581fa6d6b2fd0dbb61361c3e6bda603f0f5fded0f938ada10
AveMariaRAT
b349759ad885c5dc5e2c7c09c438529284dbc4f50eca66ff6a31a79853aad9ec
AveMariaRAT
b4e26693eb622dcf2a71d961a2dc62c74feb7b253b1cfba3168e89b987572831
AveMariaRAT
+ 553 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer persistence rat
Link:
https://tria.ge/reports/230802-pc573aef29/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Warzone RAT payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
plazzasecretballeronline.onedumb.com:14977
Unpacked files
SH256 hash:
83f19467ccf72ef1f39f298f2f91a512cce6021e8f81bc98a249225640cb29b8
MD5 hash:
c9915e219a2d249f9b1f062b6a41530c
SHA1 hash:
9d230c9ea12189f5f351d864537108f32e7e7c0d
Link:
https://www.unpac.me/results/f0df59a1-0e9d-409e-b5b6-9fc1f024e100/
SH256 hash:
02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9
MD5 hash:
c3d2671ab969fd347e6e0b81c777fc48
SHA1 hash:
43d9902d2a7b0583be43ef8d4023c81e9a776e52
Link:
https://www.unpac.me/results/f0df59a1-0e9d-409e-b5b6-9fc1f024e100/
Malware family:
Warzone
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02ef992b9a58/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AveMaria
Create hunting rule
Author:@bartblaze
Description:Identifies AveMaria aka WarZone RAT.
Rule name:ave_maria_warzone_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_1_RID2C2D
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding command execution via IExecuteCommand COM object
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_AveMaria
Create hunting rule
Author:ditekSHen
Description:AveMaria variant payload
Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects SystemBC
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_AveMaria_31d2bce9
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/439844/

Comments