MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a5943219f8400531a411b909b666337ba4f232d19e003a0128e0d699106f04f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 3

Intelligence 3 IOCs YARA 6 File information Comments

SHA256 hash:	3a5943219f8400531a411b909b666337ba4f232d19e003a0128e0d699106f04f
SHA3-384 hash:	3bfa54751cd890d9745084243c6af7ce3119b8646f2ea6f8e94eba09634dd45f8cfd63a1085af34aab66aad591208b0b
SHA1 hash:	51ef9cb92805c807f4b7effe25a4171c310ae8ae
MD5 hash:	69e4dd490a6b0fd7740dd7eb3a0020e2
humanhash:	floor-lima-october-spaghetti
File name:	Order and Quote.xlsm
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	96'055 bytes
First seen:	2020-05-20 08:30:29 UTC
Last seen:	2020-05-20 09:48:50 UTC
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	1536:lUvPZx6gTmCLlJingUR4WY48xz3jRVvO0o0bQOfdlaRM6lv+JzYX23iJ8oR:lUH9Tm+WgUWz31dO0olOfafIOXLd
TLSH	F7936C07D912B05FC526047113B778D2EA7606A3BB670F8F2F0569B095036EAFB32D69
Reporter	abuse_ch
Tags:	AveMariaRAT RAT xlsm Yahoo

abuse_ch

Malspam distributing AveMariaRAT:

HELO: sonic303-20.consmr.mail.sg3.yahoo.com
Sending IP: 106.10.242.37
From: gorden@comleds-lighting.com <gordencomleds.lighting@yahoo.com>
Reply-To: gorden@comleds-lighting.com <gordencomleds.lighting@yahoo.com>
Subject: QUOTE AND ORDER
Attachment: Order and Quote.xlsm

AveMariaRAT payload URL:
http://111.90.149.244/cvs.exe

AveMariaRAT C2:
192.154.229.128:5200

Intelligence

File Origin

# of uploads :

# of downloads :

103

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.VBA.SCrypted.1.Gen.2057.16284.UNOFFICIAL

Gathering data

Threat name:

Document-Word.Downloader.Rdn

Status:

Malicious

First seen:

2020-05-20 09:42:07 UTC

File Type:

Document

Extracted files:

AV detection:

14 of 31 (45.16%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hjmugim7qqafggsbdoijwztdg65e6izndhqahiasrygwteig6bhq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-r9y7d39k1n/

Behaviour

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Office loads VBA resources, possible macro or embedded object present

Blacklisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://111.90.149.244/cvs.exe

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	win_ave_maria_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator