MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 122ef85900670d4776f3afdbe676d59c23c4cd9944b9d392eb9a446b3bb40dde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 122ef85900670d4776f3afdbe676d59c23c4cd9944b9d392eb9a446b3bb40dde
SHA3-384 hash: 8e3d00cbfa462ccfec0f823c05e4b30128d185e4e8a0a3bbb5f0b611ce734500defb6b5bbe868b14c07e55357ee84fe9
SHA1 hash: fa6e142241720803d86e5db20e3ca84a35a45c98
MD5 hash: 9b11cbd26698cc6e7f4cf9aaecf29bb9
humanhash: pizza-cola-avocado-alanine
File name:122ef85900670d4776f3afdbe676d59c23c4cd9944b9d392eb9a446b3bb40dde
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'033'896 bytes
First seen:2020-11-10 12:08:35 UTC
Last seen:2024-07-24 11:23:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29bafab125b24273c16685612addbb04 (6 x ModiLoader, 1 x AveMariaRAT, 1 x RemcosRAT)
ssdeep 12288:rsY0CUNIjFsYrD1XHd9F2/VCRJinuqUNw/LRrB9VGo+8bD2E3xtLPZVOE4MR2b8I:r5xU+rD1XH6zrB9pdhJZaWiXQW
Threatray 883 similar samples on MalwareBazaar
TLSH CB259E62B2918937F13BEA38CD3797B76936FE102D28994727F42D4C5F392817825293
Reporter madjack_red
Tags:AveMariaRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Changing a file
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/528100
Signature
Allocates memory in foreign processes
Contains functionality to hide user accounts
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 313144 Sample: GuYXnzIH45 Startdate: 10/11/2020 Architecture: WINDOWS Score: 100 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected AveMaria stealer 2->41 43 Contains functionality to hide user accounts 2->43 6 GuYXnzIH45.exe 2 23 2->6         started        11 Mwokdrv.exe 21 2->11         started        13 Mwokdrv.exe 21 2->13         started        process3 dnsIp4 25 cdn.discordapp.com 162.159.130.233, 443, 49716, 49730 CLOUDFLARENETUS United States 6->25 23 C:\Users\user\AppData\Local\...\Mwokdrv.exe, PE32 6->23 dropped 45 Writes to foreign memory regions 6->45 47 Allocates memory in foreign processes 6->47 49 Creates a thread in another existing process (thread injection) 6->49 15 ieinstal.exe 3 4 6->15         started        51 Multi AV Scanner detection for dropped file 11->51 53 Injects a PE file into a foreign processes 11->53 19 ieinstal.exe 1 11->19         started        21 ieinstal.exe 1 13->21         started        file5 signatures6 process7 dnsIp8 27 tulick.hopto.org 54.39.198.228, 4902, 49728 OVHFR Canada 15->27 29 Tries to steal Mail credentials (via file access) 15->29 31 Tries to harvest and steal browser information (history, passwords, etc) 15->31 33 Increases the number of concurrent connection per server for Internet Explorer 15->33 35 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->35 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/122ef85900670d4776f3afdbe676d59c23c4cd9944b9d392eb9a446b3bb40dde/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 05:40:01 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
411a64366a6b5b9e57bd06dcdccd377ea02d9ed7e8be0f290f0674e3d7ff3215
AveMariaRAT
5cbed2f8a5fdadbd99816c4c8792bd51a2db7479f80bf70409f0f257f942d0c9
AveMariaRAT
6c483817d7c95cd3ac3be070d84f1647b938ad3341f7b4854924a77892507af8
AveMariaRAT
7c29f8e756680bbd35e79d6c0b6e6207b7dc20bed7daa06e7ecc4381c0db9300
AveMariaRAT
803ed954a2fbfa36e1b154d7b1b6b270021eb72583d5a876e5aaedd728c39cc7
AveMariaRAT
82b070a42d50b8e37b551543e041933140f3823138b0997fccd4ad926df8183b
AveMariaRAT
91292df65ea051a8cd7009382fb66c6b3fed39e8ddc3a27e38c990e2b69ea942
AveMariaRAT
a0792945510f126714a42e9b4cef8b7e8d7aab504772b076c6df0a4e96f08e89
AveMariaRAT
a5e7f494eb61368332811160955db5ef4dc5f07e6e3fbc7d5c0776023d3714c0
AveMariaRAT
d30b949fc05b15b611b3fe420b6883062c5bb2b270c769540c48f703a46cbbf3
AveMariaRAT
+ 873 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:warzonerat infostealer persistence rat spyware trojan
Link:
https://tria.ge/reports/201110-9l3lekmw1a/
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
JavaScript code in executable
Loads dropped DLL
Reads user/profile data of web browsers
ModiLoader First Stage
ModiLoader Second Stage
Warzone RAT Payload
ModiLoader, DBatLoader
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments