MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48dfff1ba8fcad5b9199dd4ab064fa9173db570cc46e8b31f4bc288e15846109. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48dfff1ba8fcad5b9199dd4ab064fa9173db570cc46e8b31f4bc288e15846109
SHA3-384 hash: 9dba4f0fc88613806b362bfb408e6e098ea19624c61061af346ed576ae176a65d7a27aa135b904111054e818e1c23e55
SHA1 hash: 09f4ca43059c1338450d9596a499d37fd4d43bdf
MD5 hash: 8abe9d4d96be9b1882433cd556f71ccc
humanhash: speaker-cardinal-twenty-blossom
File name:48dfff1ba8fcad5b9199dd4ab064fa9173db570cc46e8b31f4bc288e15846109
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:103'968 bytes
First seen:2020-06-29 07:45:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 18a2358d93fae265f5b597fafaf23bed (1 x AveMariaRAT)
ssdeep 1536:ZvqIPE8ddFD1frrq7gVxoNGPNwF1d536z:wI8CxFVxAMNwl536z
Threatray 424 similar samples on MalwareBazaar
TLSH C7A39E1377D18439F6B101B02CA97A7ACABEBF380321855BE72456076F719D4EA353A3
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15909/
Detection(s):
PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.Ep-7
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/48dfff1ba8fcad5b9199dd4ab064fa9173db570cc46e8b31f4bc288e15846109/
Threat name:
Win32.Trojan.WarzoneRAT
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 21:37:00 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
54740b083071363aa774760bd55013cbcc2ee8e856bf8ac97a383601a5bc666e
AveMariaRAT
6d59e992902a831d4c7a16213cd940ae06d597feedddc2aa011ea85ffc1e32b9
AveMariaRAT
6e7cb3410b7189f1334bea37863662a29aedf4a504175127075fb85fd0e03ee9
AveMariaRAT
7b7b7e7ad9b106a5508583f1b60e3a3d7385bf0d6592ca816839f6633f5e8045
AveMariaRAT
8fbd0e656a1ee90b82591111e01fb0e8b7a3d3e711e0d5165d05a5d844b8c03f
AveMariaRAT
9c62d911a4efd2a37364d26439085d493ca2ab7e4b0fa90ba2f5d937e99e5bdf
AveMariaRAT
9ce5eb576c72ecc29eabbbece917f1873bf4f5782485b22549dfbb6ff1d56f58
AveMariaRAT
a860b7f6787c55f457249bf722d6ce93034391889c05f6ec0c9e10befe8c8c03
AveMariaRAT
ac0aacc526d6b71995cdc6b64bb66a727a92acc4cd2869e9abcfc16dfee8189f
AveMariaRAT
b38f7cacc56a97f122827cc2e89c55c9747ad790f7649b6078cedca83659b4dc
AveMariaRAT
+ 414 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-gtm2nnfkbe/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15909/

Comments