MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2
SHA3-384 hash: 2570c7e1933b4960be14a5d0e6ed48de00a1501ba1a3efb22497cdbd33e744944f7d780888ba9f862815d109ae8e3536
SHA1 hash: adc14f8e1e0c1961369f7988b15fa5998229853c
MD5 hash: ace73aa80bc1cdd78d68179c53b96d64
humanhash: hamper-october-cat-october
File name:Swift Confirmation Detail 000797427.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:311'296 bytes
First seen:2023-04-14 06:11:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:m8y+ipIbufqDye3NCT8yGjm04y0O12udoEUA:m9pLiCgD4wldE
Threatray 2'240 similar samples on MalwareBazaar
TLSH T13E64BE18314777DFCB0747F1D6AF4C1493B1AA99E20FCE0B2086E2E8499B6968B1D1DD
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d2e8ecb2b2a2b282 (106 x AgentTesla, 106 x Formbook, 24 x RedLineStealer)
Reporter abuse_ch
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
245
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
avemaria
Create hunting rule
ID:
1
File name:
Swift Confirmation Detail 000797427.exe
Verdict:
Malicious activity
Analysis date:
2023-04-14 06:23:49 UTC
Tags:
stealer warzone rat avemaria
Link:
https://app.any.run/tasks/361a4f1d-3f32-4cc7-a40f-ab2ae0cb3210

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/382178/
Detection(s):
SecuriteInfo.com.Variant.Tedy.271864.13079.29277.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a file
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
75%
Tags:
aspnet_compiler.exe confuserex packed packed
Link:
https://www.filescan.io/uploads/6438eeb58cbb8f4be303ba55/reports/678a2dc6-f21e-41d6-9dcb-eae23650d5e7/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AVE_MARIA
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/362a8cd2-4544-491c-9330-b34654d3222e
Result
Threat name:
AgentTesla, AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1213673
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 846601 Sample: Swift_Confirmation_Detail_0... Startdate: 14/04/2023 Architecture: WINDOWS Score: 100 46 Snort IDS alert for network traffic 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 12 other signatures 2->52 8 Swift_Confirmation_Detail_000797427.exe 5 2->8         started        process3 file4 28 C:\Users\user\AppData\...\RZTHXHelper.exe, PE32 8->28 dropped 30 Swift_Confirmation...l_000797427.exe.log, ASCII 8->30 dropped 62 Writes to foreign memory regions 8->62 64 Allocates memory in foreign processes 8->64 66 Injects a PE file into a foreign processes 8->66 12 aspnet_compiler.exe 3 19 8->12         started        17 powershell.exe 1 22 8->17         started        signatures5 process6 dnsIp7 42 91.192.100.10, 11011, 49696 AS-SOFTPLUSCH Switzerland 12->42 44 transfer.sh 144.76.136.153, 443, 49697 HETZNER-ASDE Germany 12->44 32 C:\Users\user\AppData\Roaming\hFJirkh.D.exe, PE32+ 12->32 dropped 34 C:\Users\user\AppData\Local\...\HHhH76[1].exe, PE32+ 12->34 dropped 76 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->76 78 May check the online IP address of the machine 12->78 80 Increases the number of concurrent connection per server for Internet Explorer 12->80 82 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->82 19 hFJirkh.D.exe 1 12->19         started        22 conhost.exe 17->22         started        file8 signatures9 process10 signatures11 54 Antivirus detection for dropped file 19->54 56 Machine Learning detection for dropped file 19->56 58 Writes to foreign memory regions 19->58 60 2 other signatures 19->60 24 aspnet_compiler.exe 15 2 19->24         started        process12 dnsIp13 36 stamtooling.com 204.11.58.33, 49699, 587 PUBLIC-DOMAIN-REGISTRYUS United States 24->36 38 api4.ipify.org 104.237.62.211, 443, 49698 WEBNXUS United States 24->38 40 api.ipify.org 24->40 68 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->68 70 Tries to steal Mail credentials (via file / registry access) 24->70 72 Tries to harvest and steal browser information (history, passwords, etc) 24->72 74 Installs a global keyboard hook 24->74 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2/
Threat name:
ByteCode-MSIL.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2023-04-14 04:09:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
13 of 35 (37.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvlydiphttw6y42s5hmf5mfj6zg3xxxgq47eqher4noequc6nora._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
28899cd77a674fd8fc103e44aa12ce58b76dadcdcdecca0637c774df8dbdc61c
AveMariaRAT
64f2a6308c94b35be90cc1085538912c33956c06182756cd324f6874ae6c62f6
AveMariaRAT
697414704680ccefd9708f44942e42efbfcba4009ae2029f0a6ad964051b36ba
AveMariaRAT
853e1ec7d4d8fa449d88746cab1bfac6074e0d81e9a26ef6948793059e9bd781
AveMariaRAT
8aefec7573b95dd50f25085dfad2459b660d811303a6d6614b0044ddb97a8dee
AveMariaRAT
91dfad54225bba811d942c058df7c85785f22330dcbc96ae62bf2f19eb17b65f
AveMariaRAT
a52f80f4e0495d340679de0ea87ccf96f03890089fcfaf25e5e06e721992465b
AveMariaRAT
aad314e684a4195a25d580e3e203b8064b275adba10f144d1bf69126b980f2c8
AveMariaRAT
fb9d0187ef58360b6877dc38f0509030b2e7d57d060deae2bb6e3233dda8f47d
AveMariaRAT
+ 2'230 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:warzonerat collection infostealer keylogger persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/230414-gx7mmagf23/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Warzone RAT payload
AgentTesla
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
91.192.100.10:11011
Unpacked files
SH256 hash:
477cab8d4385172d679200edc6619462de2402d912f21f36981fc058987a6d52
MD5 hash:
16a9ddc4b32981114fe4f069a4353105
SHA1 hash:
bf73849f57c150f9e2199c61427f631be2dfa595
Link:
https://www.unpac.me/results/859fc16d-42c1-4bcf-9f4c-83496e53a833/
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/859fc16d-42c1-4bcf-9f4c-83496e53a833/
SH256 hash:
bee7f070cd5d124588ebd3e6c578a001d61890b6d35b58a2e8b0b3654a2faf13
MD5 hash:
14065bc38509389676462689e03a8e27
SHA1 hash:
178add6c87cbc7d476c2c8ecb841f2bf3f6a68a9
Detections:
Warzone
Create hunting rule
win_ave_maria_auto
Create hunting rule
win_ave_maria_g0
Create hunting rule
Link:
https://www.unpac.me/results/859fc16d-42c1-4bcf-9f4c-83496e53a833/
Parent samples :
853e1ec7d4d8fa449d88746cab1bfac6074e0d81e9a26ef6948793059e9bd781
caf7cfc2d3a76c442c36aa41e192ade5c4da13e51000b8f2746cc0ced8f4e0a1
64f2a6308c94b35be90cc1085538912c33956c06182756cd324f6874ae6c62f6
555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2
SH256 hash:
f71d97c3d42af0eb4cc74e640a995eb0f288bab59b7be5cd89eccb21cd304f36
MD5 hash:
6c72218c48cd68cbcb654675053a0abb
SHA1 hash:
12207fa32070f99683648d87b44410e5d3cdf2de
Link:
https://www.unpac.me/results/859fc16d-42c1-4bcf-9f4c-83496e53a833/
SH256 hash:
555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2
MD5 hash:
ace73aa80bc1cdd78d68179c53b96d64
SHA1 hash:
adc14f8e1e0c1961369f7988b15fa5998229853c
Link:
https://www.unpac.me/results/859fc16d-42c1-4bcf-9f4c-83496e53a833/
Malware family:
Warzone
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/555781a1e79c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe 555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/382178/

Comments