MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 508af91f6a041f7c6484e5a94e921f034efc13d5e27877042693a938709b4c2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 508af91f6a041f7c6484e5a94e921f034efc13d5e27877042693a938709b4c2d
SHA3-384 hash: 39e04702ec0650efb18e4b4d796ca3c4096198d820c2ab71318685327869874cca6453b0777f8d13466386e2dcccbd17
SHA1 hash: 6ea06d00fe0d682fa44d3ecdd403975f77faeed1
MD5 hash: 4f3cb63554e8f86ee7ef55b81c8e5813
humanhash: delaware-juliet-nitrogen-pennsylvania
File name:Narudzba u prilogu.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'017'344 bytes
First seen:2022-05-03 07:18:21 UTC
Last seen:2022-05-04 11:03:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d238327224fe86b801d8740c7ecac4f5 (2 x Formbook, 1 x AveMariaRAT)
ssdeep 24576:8KzElevxJIGQGoP/oCqvqpFtVSn52XcNV:74Ox+ZdpSn52Xc
TLSH T1D4259F62F3914577D72616344C4B5BE56A36BF313E26AF4A6BF81D4C2F39380382A193
TrID 22.3% (.EXE) Win32 Executable Delphi generic (14182/79/4)
20.6% (.SCR) Windows screen saver (13101/52/3)
16.5% (.EXE) Win64 Executable (generic) (10523/12/4)
15.7% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
7.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 88c7ce3cbddc2f31 (24 x RemcosRAT, 12 x Formbook, 8 x Loki)
Reporter TeamDreier
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
avemaria
Create hunting rule
ID:
1
File name:
Narudzba u prilogu.exe
Verdict:
Malicious activity
Analysis date:
2022-05-03 07:19:10 UTC
Tags:
trojan stealer rat avemaria warzone
Link:
https://app.any.run/tasks/d5008258-f9e7-4cee-984c-b7656e2352e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/268313/
Detection(s):
SecuriteInfo.com.W32.Remcos.Q.genEldorado.23791.11191.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Launching cmd.exe command interpreter
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% directory
Reading critical registry keys
Creating a file in the %temp% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/16145/overview
Behaviour
MalwareBazaar
CheckScreenResolution
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe keylogger replace.exe
Link:
https://www.filescan.io/uploads/6270d77e62b1ae4451d04e7b/reports/f736e513-13ac-4c72-b7ee-b2b69ba2c35d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2dc93bd5-faa8-4e29-afab-b46157751cfd
Result
Threat name:
AveMaria DBatLoader UACMe
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/986906
Signature
Allocates memory in foreign processes
Contains functionality to hide user accounts
Creates a thread in another existing process (thread injection)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Writes to foreign memory regions
Yara detected AveMaria stealer
Yara detected DBatLoader
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 619402 Sample: Narudzba u prilogu.exe Startdate: 03/05/2022 Architecture: WINDOWS Score: 100 26 nweke.ddnsgeek.com 2->26 42 Snort IDS alert for network traffic 2->42 44 Multi AV Scanner detection for domain / URL 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 5 other signatures 2->48 7 Narudzba u prilogu.exe 1 17 2->7         started        12 Zjhzamf.exe 15 2->12         started        14 Zjhzamf.exe 15 2->14         started        signatures3 process4 dnsIp5 28 p5ibha.am.files.1drv.com 7->28 36 2 other IPs or domains 7->36 22 C:\Users\Public\Libraries\Zjhzamf.exe, PE32 7->22 dropped 24 C:\Users\...\Zjhzamf.exe:Zone.Identifier, ASCII 7->24 dropped 50 Writes to foreign memory regions 7->50 52 Allocates memory in foreign processes 7->52 54 Creates a thread in another existing process (thread injection) 7->54 16 logagent.exe 7->16         started        30 l-0003.l-dc-msedge.net 13.107.43.12, 443, 49774, 49776 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 12->30 32 l-0004.l-dc-msedge.net 13.107.43.13, 443, 49773, 49775 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 12->32 38 3 other IPs or domains 12->38 56 Multi AV Scanner detection for dropped file 12->56 18 DpiScaling.exe 12->18         started        34 p5ibha.am.files.1drv.com 14->34 40 2 other IPs or domains 14->40 20 logagent.exe 14->20         started        file6 signatures7 process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/508af91f6a041f7c6484e5a94e921f034efc13d5e27877042693a938709b4c2d/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2022-05-02 05:48:01 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
19 of 42 (45.24%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kcfpsh3kaqpxyzee4wuu5eq7anhpye6v4j4hobbgsoutq4e3jqwq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:warzonerat collection infostealer persistence rat trojan
Link:
https://tria.ge/reports/220503-h5htxafebp/
Behaviour
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Accesses Microsoft Outlook profiles
Adds Run key to start application
Loads dropped DLL
ModiLoader Second Stage
Warzone RAT Payload
ModiLoader, DBatLoader
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
nweke.ddnsgeek.com:6746
Unpacked files
SH256 hash:
21c0fb2b53a8dc9d38a9cef684adce53f0dd311c3e8861cddda7946408f00b77
MD5 hash:
e91f52a1d9b8f23ae40be2e76017452c
SHA1 hash:
f86fd2cfcc8513e76c7c3ae74ae03d509aa3f453
Link:
https://www.unpac.me/results/fc92374d-4bba-4974-8002-87bacc4d662a/
SH256 hash:
508af91f6a041f7c6484e5a94e921f034efc13d5e27877042693a938709b4c2d
MD5 hash:
4f3cb63554e8f86ee7ef55b81c8e5813
SHA1 hash:
6ea06d00fe0d682fa44d3ecdd403975f77faeed1
Link:
https://www.unpac.me/results/fc92374d-4bba-4974-8002-87bacc4d662a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.94
Link:
https://yomi.yoroi.company/submissions/508af91f6a041f7c6484e5a94e921f034efc13d5e27877042693a938709b4c2d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe 508af91f6a041f7c6484e5a94e921f034efc13d5e27877042693a938709b4c2d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/268313/

Comments