MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3db0da97119509327c8a494c8a5beca070c6dc51c0fe9569de478cc41917ea5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3db0da97119509327c8a494c8a5beca070c6dc51c0fe9569de478cc41917ea5e
SHA3-384 hash: f086bc284f911e8c42f1eaa60bd6c0b1ea3fa33eaf704b1d8596203e80dfe817c4a3f1914b02388b1884d523a2c72fc7
SHA1 hash: 796c93127e8fdaf7e6f5dc3f9389b1cec5fd6afe
MD5 hash: cd43e739540d881b3bf98f3f48e0fd99
humanhash: magazine-jupiter-wolfram-johnny
File name:cd43e739540d881b3bf98f3f48e0fd99.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'182'720 bytes
First seen:2020-05-18 07:06:20 UTC
Last seen:2020-05-18 08:23:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e6e0f0655a4d7c41a009f88194cf2c73 (1 x AveMariaRAT)
ssdeep 6144:tVuH06YZ1L4XqyAmeQT/gUvF1sOBoZPGKOrPFOIiNjD4mlBLtdXjJn8imM:tVl6YTLmFheQrFvFqOBC+PUIiNxLCM
Threatray 688 similar samples on MalwareBazaar
TLSH E745091163FB4205F5F37F78AAB942A10F7BBC91A939C58D129D511E0BB7E508A60B33
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
AveMariaRAT C2:
185.19.85.133:55001

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Wonton-S.3796.2081.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 08:17:00 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwynvfyrsuete7ekjfgiuw7mubymnxcryd7jk2o6i6gmigix5jpa._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
19fa55d64a5d0900b5f8604bb765ab9196e07b2716f1248e0a8c6245e12e2119
AveMariaRAT
5084295c61b6333540a33ee23df90c13e58c04884002f747be7412ed877e60db
AveMariaRAT
5743addf52ee0b08652510e2d1e295cc787bad9a0c45fc98df9980a9c5b9cee4
AveMariaRAT
668566b73ffe0c42699030779e8704261bad9d095c56cac1206170c89c5fb698
AveMariaRAT
8c74c79cb7ab3a130b3ad8f31fa7bb79f85bc9788d9e0c60e798f29050c51785
AveMariaRAT
8cfce52a39c18564723c94b57b95a4be0328bb75350e7c866ee5f674b94d26e0
AveMariaRAT
b1de8cf2d588ceb071c2549d61bec4724abffc886a42042268fdbfa9215a774b
AveMariaRAT
da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a
AveMariaRAT
ea5ada6c08dbfc308e230059c103b5a4783675baf0ddce6ee90a9030f1936ec4
AveMariaRAT
ff4bcfd3663088b0e8fed48b19bf950f8a6680fea9d3b0a478ac1fbfbcefeeef
AveMariaRAT
+ 678 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer rat
Link:
https://tria.ge/reports/201109-9r4yxxf7la/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
ServiceHost packer
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:ReactOS_cmd_valid
Create hunting rule
Author:Florian Roth
Description:ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset
Reference:http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_malumpos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe 3db0da97119509327c8a494c8a5beca070c6dc51c0fe9569de478cc41917ea5e

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments