MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e
SHA3-384 hash: e540dc179a9f7b53bea43cbd90b5a6a6d0605a874dc3f82adee5591e4c31781d205caf52ccb822594cbd90fd7a548261
SHA1 hash: 61c95c346b2c07d5a7ac2bb1d30745903a3ad99b
MD5 hash: c8cc1aa9f0824c83a98cf9072d0079cb
humanhash: emma-victor-carolina-football
File name:New supplier Inquiry and PO 208202750_ DOC.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:431'104 bytes
First seen:2020-08-27 05:26:00 UTC
Last seen:2020-08-27 06:18:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 6144:q4fCLA0ydaM+LB76X4GLMK6ts3aYQsF90QIFnN78+HXyZnS6PfHZB:BkA0y1JZMBU7Mw+HiZLH
Threatray 478 similar samples on MalwareBazaar
TLSH 7D94E065126D8F05EDE9CAB9D46D2FC302F2BC45616CD33E5E4CB39A24B1B908D82793
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp.aonbd.net
Sending IP: 117.58.240.41
From: Purchase Vertex Safety A.S <purchase.vertexsafety.com@protonmail.com>
Reply-To: Purchase Vertex Safety A.S <purchase.vertexsafety.com@protonmail.com>
Subject: Re: New Supplier Inquiry Vertex Instanbul Safety/Equipment/PO208202.
Attachment: New supplier Inquiry and PO 208202750_ DOC.zip (contains "New supplier Inquiry and PO 208202750_ DOC.exe")

AveMairaRAT C2:
divy.nerdpol.ovh:5200 (51.91.36.150)

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51576/
Detection(s):
SecuriteInfo.com.Fareit-FYVC8CC1AA9F082.1287.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a process with a hidden window
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/452229
Signature
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to hide user accounts
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides user accounts
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 278474 Sample: New supplier Inquiry and PO... Startdate: 27/08/2020 Architecture: WINDOWS Score: 100 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 Sigma detected: Scheduled temp file as task from temp location 2->40 42 9 other signatures 2->42 7 New supplier Inquiry and PO 208202750_ DOC.exe 5 2->7         started        11 tsusbhub.sys 3 2->11         started        13 rdpdr.sys 8 2->13         started        15 rdpvideominiport.sys 4 2->15         started        process3 file4 28 C:\Users\user\AppData\...\QUOgnpwGsI.exe, PE32 7->28 dropped 30 C:\Users\user\AppData\Local\...\tmpB5CE.tmp, XML 7->30 dropped 32 New supplier Inqui...202750_ DOC.exe.log, ASCII 7->32 dropped 52 Injects a PE file into a foreign processes 7->52 17 New supplier Inquiry and PO 208202750_ DOC.exe 8 5 7->17         started        22 schtasks.exe 1 7->22         started        signatures5 process6 dnsIp7 34 divy.nerdpol.ovh 51.91.36.150, 49710, 5200 OVHFR France 17->34 26 C:\Program Files\Microsoft DN1\sqlmap.dll, PE32+ 17->26 dropped 44 Hides user accounts 17->44 46 Tries to steal Mail credentials (via file access) 17->46 48 Increases the number of concurrent connection per server for Internet Explorer 17->48 50 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->50 24 conhost.exe 22->24         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:27:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ew6yxytisr3uipdknoe4ggk33anxgoctvjcqft6rjjxcll6dpgha._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0ae65f7c31f2d20b9e4dbd96e2dde3162f2396bc2fd18be6cfd88f6118eb0778
AveMariaRAT
244d44fda9c8c6d0824059551aaf4a8f983affe67a77e9ce31459de208be4609
AveMariaRAT
263bb9ed145f4847b527e4c0a1ad93fa24ad2fd0859a11825fe9d3cc97d5367b
AveMariaRAT
2d057909c6426fff14883d8ce85238843d07b25aeba5981219150ef72a33e49e
AveMariaRAT
4c0ba445450f16973c204aaab8265d888df2d38f822fbfcdf15249fbc3863356
AveMariaRAT
5623d57806cdca9774c3a13899e361f66948b648303e491bb79072faa715930c
AveMariaRAT
996ede8d9cb8561481707de2768ca29bf7294c66ac1de666cb390417eb2d9d60
AveMariaRAT
a4aa4637f92e6d1f0faea8c071cd561b154e3539a169976ebede90acf6760b99
AveMariaRAT
be2bc33b9acb5b939bc7cba84521cda274380a09b4acbe6e9696b8183352b5e8
AveMariaRAT
fe3f9f59dc784955366a2f7c9ff189b39710704b890b2e3aae3ffd0fbdac7539
AveMariaRAT
+ 468 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence spyware
Link:
https://tria.ge/reports/200827-gbbdq5lpe6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Program Files directory
Drops file in System32 directory
Modifies service
Suspicious use of SetThreadContext
Drops file in System32 directory
Modifies service
Suspicious use of SetThreadContext
JavaScript code in executable
Maps connected drives based on registry
Modifies WinLogon
JavaScript code in executable
Maps connected drives based on registry
Modifies WinLogon
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Sets DLL path for service in the registry
Looks for VMWare Tools registry key
Sets DLL path for service in the registry
Looks for VirtualBox Guest Additions in registry
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_ave_maria_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

zip 9cd417da68471226ae74dfdcb89a506d591b50561be9f596f894178adc0d366e

AveMariaRAT

Executable exe 25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e

(this sample)

  
Dropped by
MD5 51c45fd730a27394da19cfe296e6cb3b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/51576/
  
Dropped by
SHA256 9cd417da68471226ae74dfdcb89a506d591b50561be9f596f894178adc0d366e

Comments