MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e0cc4051f5ea6cb75b0df551bc5be60abc54ca51cd1611dc760aa245a0055dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e0cc4051f5ea6cb75b0df551bc5be60abc54ca51cd1611dc760aa245a0055dd
SHA3-384 hash: d7ed7247ea7393b5500abef6b88ea09109945487ccae6c3a33774b3b59e1169e8c25d8e4a7fc55fd331e26b0e9f65d5b
SHA1 hash: 00bbd7b66698ebc534bfcb42e65b8b30816458bd
MD5 hash: f6c0f66dddb1c6e83a62c3a17b5e98b6
humanhash: zulu-freddie-early-xray
File name:file
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:100'352 bytes
First seen:2020-02-28 03:36:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b76aafdc988ade2ab3db3b02fa4c6d00 (26 x AveMariaRAT, 1 x njrat, 1 x NanoCore)
ssdeep 1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG
Threatray 415 similar samples on MalwareBazaar
TLSH B6A38D2377E1443DF67502B02ABCBE7A97FEBD750321895FA36811836E72548E926343
Reporter johannes
Tags:ave AveMariaRAT


Avatar
viql
ave via https://pastebin.com/raw/T0411tdg

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Agent-7653899-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Maria.3.30306.22950.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Mocrt
Create hunting rule
Status:
Malicious
First seen:
2020-01-10 04:43:36 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
12fa05928175822dc4f3aacc86b8dcdab77e5f35d1a4a2f54b8762dbc6f8a236
AveMariaRAT
2002e2506e59be859c12de94b1d9ddbfeeee31373684ce15f4e5b952da036a69
AveMariaRAT
4fed79d044df2a4c1c7fe6261a9b557de0c8940f5b92d853892a619537bd989f
AveMariaRAT
6998249e77f7c33821b3678fbdbc0a843ca39d80d49aa55335b48ef7c4011ad2
AveMariaRAT
6c08295f40c3b798331023edf5166fc3dc159f120eaf02db0991f6d682c7df13
AveMariaRAT
b01d0e871f96ddcf4df2358b7a452c488d628829d14d5ede0a58243cdd1dbdc7
AveMariaRAT
cad851d943cb185cb15220b74b66ba5f60058d0b155c020db6b71315183f940c
AveMariaRAT
e3ec188cee8aedebacb4156103cebe176b3521415be6de03ec98304d94963498
AveMariaRAT
e758f3d0b0d2ef46c65b0111f5507f17d65a86df34a52d49c458fa1752e9b96c
AveMariaRAT
eee4d211bbffe896f0de21854cb5adac6e10c85016986efd260b45c7022d7521
AveMariaRAT
+ 405 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer rat
Link:
https://tria.ge/reports/201109-w699g27ba6/
Behaviour
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e0cc4051f5ea6cb75b0df551bc5be60abc54ca51cd1611dc760aa245a0055dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::FreeSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
DP_APIUses DP APICRYPT32.dll::CryptUnprotectData
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetTokenInformation
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::ShellExecuteExA
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateRemoteThread
KERNEL32.dll::CreateProcessW
KERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::VirtualAllocEx
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
SHELL32.dll::SHCreateDirectoryExW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::LookupAccountSidW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryInfoKeyW
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::freeaddrinfo
WS2_32.dll::getaddrinfo
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfigW
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenServiceW
ADVAPI32.dll::QueryServiceConfigW
ADVAPI32.dll::StartServiceW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateWindowExW

Comments