MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e987e3a9b9acf4b39c0ed11956481818d7bd758e58d171acb7ed22ef6dfed9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	2e987e3a9b9acf4b39c0ed11956481818d7bd758e58d171acb7ed22ef6dfed9e
SHA3-384 hash:	850a20aaed0ab042d344fb48672d8c42b92f3609abc1982463de9347e18d5120d5a33aae12b29bc3b452c295aad83dfe
SHA1 hash:	a20ece2e6cbc13902e6df9d0518aba1a8eef5e2a
MD5 hash:	5bb74b272fa5a52cd23c383541b063b1
humanhash:	lemon-white-burger-beer
File name:	P.O CCJSC10052033_160522TQO.ace
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	454'781 bytes
First seen:	2022-05-16 13:43:23 UTC
Last seen:	Never
File type:	ace
MIME type:	application/octet-stream
ssdeep	12288:ePMQSxlx7bRr7p6j8BxyK4WJIrq+dzmGC:wMQSxlxHp7kj8XdR+dqD
TLSH	T1ECA4237FC69B7A8A6207072DE21B7729AC486A49B9DF2437C27417C54D66EFB8F5000C
Reporter	cocaman
Tags:	ace AveMariaRAT

cocaman

Malicious email (T1566.001)
From: "Vo Hoang Lam<tandt@coteccons.vn>" (likely spoofed)
Received: "from mail.corytrans.click (mail.corytrans.click [64.225.65.79]) "
Date: "16 May 2022 06:20:46 -0700"
Subject: "COTECCONS New Order"
Attachment: "P.O CCJSC10052033_160522TQO.ace"

Intelligence

File Origin

# of uploads :

# of downloads :

176

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6282553422b733139c20dacc/reports/70f0e1e0-9801-46eb-a17c-2b291400b67a/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e987e3a9b9acf4b39c0ed11956481818d7bd758e58d171acb7ed22ef6dfed9e/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2022-05-16 13:44:07 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

12 of 41 (29.27%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f2mh4ou3tlhuwooa5uizkzebqggxxv2y4wgrogwlp3jc55w75wpa._file

Result

Malware family:

warzonerat

Score:

10/10

Tags:

family:warzonerat infostealer rat

Link:

https://tria.ge/reports/220516-q1tdvachc8/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Warzone RAT Payload

WarzoneRat, AveMaria

Malware Config

C2 Extraction:

gratiyupo.ddnsfree.com:7344

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2e987e3a9b9acf4b39c0ed11956481818d7bd758e58d171acb7ed22ef6dfed9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ACE_Containing_EXE Create hunting rule
Author:	Florian Roth - based on Nick Hoffman' rule - Morphick Inc
Description:	Looks for ACE Archives containing an exe/scr file