MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e9fd7e59d03db74b99c3a9977ce4df9f073b4de25377bb63ce0ce33005b9316. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 14 File information Comments

SHA256 hash:	2e9fd7e59d03db74b99c3a9977ce4df9f073b4de25377bb63ce0ce33005b9316
SHA3-384 hash:	0a57eccad6213eb3b8b2470b07482958a7a8f897e7f85619f30eb0569fc8faa4d3798bc9154dbffd3d46a64c245c4e13
SHA1 hash:	88ece1412900fbc155ee150776f90ab4bd7b7120
MD5 hash:	e42a5e95457268751571d86e1385c925
humanhash:	potato-minnesota-early-zulu
File name:	PURCHASE ORDER 2022GH0053 PDF.exe
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	24'064 bytes
First seen:	2022-06-15 05:18:56 UTC
Last seen:	2022-06-15 09:06:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	192:qHA1a/NoZKozm8S2kjDnVvZiJ09tGR6H1iS2j5owhtFhseGK:qHfNocmPSB/n71GAH1zORXG
Threatray	3'448 similar samples on MalwareBazaar
TLSH	T1CCB2C309E6E6C132D69019F6DE6262D0873C5D07D953AA1FEA46731E28F325CD888BF1
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	b1b1b17964989c06 (31 x SnakeKeylogger, 4 x AgentTesla, 3 x XWorm)
Reporter	GovCERT_CH
Tags:	AveMariaRAT exe WarzoneRAT

Intelligence

File Origin

# of uploads :

# of downloads :

281

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PURCHASE ORDER 2022GH0053 PDF.exe

Verdict:

Malicious activity

Analysis date:

2022-06-15 05:21:13 UTC

Tags:

warzone

Link:

https://app.any.run/tasks/ab929b9a-6c24-4fbf-9b98-354b8c264400

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

WarzoneRAT

Link:

https://www.capesandbox.com/analysis/280024/

Detection(s):

SecuriteInfo.com.W32.AIDetectNet.01.5893.25231.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Launching a process

Sending a custom TCP request

Сreating synchronization primitives

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62a96bd53c52ddca42d9edfb/reports/1b66e32d-3f80-476e-9af7-e1ecef3fdf39/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bb812a81-6acf-452b-b565-200dba4d4218

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1013415

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

Executable has a suspicious name (potential lure to open the executable)

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e9fd7e59d03db74b99c3a9977ce4df9f073b4de25377bb63ce0ce33005b9316/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2022-06-15 04:28:45 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f2p5pzm5apnxjom4hkmxptsn7hyhhng6eu3xxnr44dhdgac3smla._file

Verdict:

malicious

Label(s):

avemaria

AveMariaRAT

4abd870d8eb2906d9078054500da763598f720b23d21b97cececb3829a4a06c7

AveMariaRAT

5852bf7347b25ab7e1f19cd1ce6e09a5c0fd0a6bf3282db4273e0a2446476af7

AveMariaRAT

59f442a1ef0ed0ce7891f868e1aa234cff02ae471c6ab9bffdfbdb308065cd9f

AveMariaRAT

84d5ccba988508bb603f776e189e83bc500a7e96ff59fafe824a8418526b4cfc

AveMariaRAT

87b49f5381e9870bfda19fe73f05fbead0fa012553ed7a4ca03e69228bd0618c

AveMariaRAT

bb95fa20a55260f729584b7932c7dba208dcc5b0a7597be447a72e481e0dcb09

AveMariaRAT

+ 3'438 additional samples on MalwareBazaar

Result

Malware family:

warzonerat

Score:

10/10

Tags:

family:warzonerat infostealer persistence rat

Link:

https://tria.ge/reports/220615-fztywaagh2/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Warzone RAT Payload

WarzoneRat, AveMaria

Malware Config

C2 Extraction:

37.0.8.145:55588

Unpacked files

SH256 hash:

2e9fd7e59d03db74b99c3a9977ce4df9f073b4de25377bb63ce0ce33005b9316

MD5 hash:

e42a5e95457268751571d86e1385c925

SHA1 hash:

88ece1412900fbc155ee150776f90ab4bd7b7120

Link:

https://www.unpac.me/results/65733213-8aaf-4932-b14c-c25c34be727d/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2e9fd7e59d03/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2e9fd7e59d03db74b99c3a9977ce4df9f073b4de25377bb63ce0ce33005b9316

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AveMaria Create hunting rule
Author:	@bartblaze
Description:	Identifies AveMaria aka WarZone RAT.

Rule name:	ave_maria_warzone_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_1_RID2C2D Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding command execution via IExecuteCommand COM object

Rule name:	MALWARE_Win_AveMaria Create hunting rule
Author:	ditekSHen
Description:	AveMaria variant payload

Rule name:	MALWARE_Win_WarzoneRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AveMaria/WarzoneRAT

Rule name:	MAL_Lokibot_Stealer Create hunting rule
Description:	Detects Lokibot Stealer Variants

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_imphash Create hunting rule

Rule name:	RDPWrap Create hunting rule
Author:	@bartblaze
Description:	Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:	https://github.com/stascorp/rdpwrap