MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c65b9e49af0ac895cb7cbe2099df2897989de14251326355890db7238a1d340. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 19 File information Comments

SHA256 hash:	4c65b9e49af0ac895cb7cbe2099df2897989de14251326355890db7238a1d340
SHA3-384 hash:	a024483873792e59f18b05f2f567ea6e5bd8d3dc487fcb1b17736bbd9b33f76457967deb1ec806c3b0fea4bb8fb01b21
SHA1 hash:	90ff28f9b027b7a2c10c0dd4f753c79446afa413
MD5 hash:	1965ca635ff28862279965a6182d9b8c
humanhash:	eight-crazy-carbon-johnny
File name:	Zv3r4M6NeJOSoDQ.exe
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	450'560 bytes
First seen:	2021-02-17 13:31:15 UTC
Last seen:	2021-02-17 16:09:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:HWAuuR4HCKvHF6uVkIaUMcpRDuQ/xAMH1BTC7/kyKHMqyGjAzCQcLDJXNNXt/XuE:HTKHPRaUMcbSckkxMqQcXFNNd/+oR
Threatray	731 similar samples on MalwareBazaar
TLSH	B3A4CE2333D8DB5AD47957B58012C3F013F2FC069226DA1FAD997D5B3CA5AC582A63C2
Reporter	abuse_ch
Tags:	AveMariaRAT exe nVpn RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: llsa987-a17.servidoresdns.net
Sending IP: 82.223.190.28
From: manuel.aviles <manuel.aviles@tecnomed2000.com>
Subject: Request for order quotation
Attachment: Order specification drawing.rar (contains "Zv3r4M6NeJOSoDQ.exe")

AveMariaRAT C2:
iyhto.ddns.net:8044 (194.5.98.26)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-NO
country: NO
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-10-07T21:35:29Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.CAP_HookExKeylogger.31970.3586.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AveMaria

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/610314

Signature

Allocates memory in foreign processes

Binary contains a suspicious time stamp

Contains functionality to hide user accounts

Contains functionality to log keystrokes (.Net Source)

Creates a thread in another existing process (thread injection)

Detected unpacking (creates a PE file in dynamic memory)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Increases the number of concurrent connection per server for Internet Explorer

Injects a PE file into a foreign processes

Installs a global keyboard hook

Malicious sample detected (through community Yara rule)

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected AntiVM_3

Yara detected AveMaria stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

avemaria

Link:

https://mwdb.cert.pl/sample/4c65b9e49af0ac895cb7cbe2099df2897989de14251326355890db7238a1d340/

Threat name:

ByteCode-MSIL.Backdoor.NanoBot

Status:

Malicious

First seen:

2021-02-17 13:32:07 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jrs3tze26cwisxfxzprathpsrf4ytxqueujsmnkysdnxeofb2naa._file

Verdict:

malicious

Label(s):

avemaria

AveMariaRAT

19fa55d64a5d0900b5f8604bb765ab9196e07b2716f1248e0a8c6245e12e2119

AveMariaRAT

5743addf52ee0b08652510e2d1e295cc787bad9a0c45fc98df9980a9c5b9cee4

AveMariaRAT

6142ce64bdf7d4373dedcadb54fb06efed10595a65713783f2930eb1ebb9f989

AveMariaRAT

84b4040d764a758414d6e7d913161c97846e563eb18e3497f207670f9d239bc8

AveMariaRAT

8bcdcd3db1dd3688101b18e4c090194ce7ac4e96ef206e56d5595e467cf25e46

AveMariaRAT

8c74c79cb7ab3a130b3ad8f31fa7bb79f85bc9788d9e0c60e798f29050c51785

AveMariaRAT

8cfce52a39c18564723c94b57b95a4be0328bb75350e7c866ee5f674b94d26e0

AveMariaRAT

c973d5e41c51df55c3b09912bd981cd4872c3a65869f298ffb281db49ba1bc2a

AveMariaRAT

ff4bcfd3663088b0e8fed48b19bf950f8a6680fea9d3b0a478ac1fbfbcefeeef

AveMariaRAT

+ 721 additional samples on MalwareBazaar

Result

Malware family:

warzonerat

Score:

10/10

Tags:

family:warzonerat infostealer rat

Link:

https://tria.ge/reports/210217-5q5fq1kxlx/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Warzone RAT Payload

WarzoneRat, AveMaria

Unpacked files

SH256 hash:

b2499a2af35b550fbe7f541a14ff1225e1202324f351eecf85de6c8e9fc7c27c

MD5 hash:

5e732e4265622675313195dead01047e

SHA1 hash:

359c710a93c2f58cdc2a45de8dd48a6884a70645

Link:

https://www.unpac.me/results/76ebcc16-b4c5-4520-919c-4a4f38d997ba/

SH256 hash:

4c65b9e49af0ac895cb7cbe2099df2897989de14251326355890db7238a1d340

MD5 hash:

1965ca635ff28862279965a6182d9b8c

SHA1 hash:

90ff28f9b027b7a2c10c0dd4f753c79446afa413

Link:

https://www.unpac.me/results/76ebcc16-b4c5-4520-919c-4a4f38d997ba/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AveMaria Create hunting rule
Author:	@bartblaze
Description:	Identifies AveMaria aka WarZone RAT.

Rule name:	AveMaria_WarZone Create hunting rule

Rule name:	ave_maria_warzone_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	MALWARE_Win_AveMaria Create hunting rule
Author:	ditekSHen
Description:	AveMaria variant payload

Rule name:	MALWARE_Win_WarzoneRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AveMaria/WarzoneRAT

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	Ping_Del_method_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	cmd ping IP nul del

Rule name:	RDPWrap Create hunting rule
Author:	@bartblaze
Description:	Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:	https://github.com/stascorp/rdpwrap

Rule name:	Stealer_word_in_memory Create hunting rule
Author:	James_inthe_box
Description:	The actual word stealer in memory

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com