MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57c591ad1d83e9b2cd563ddf979d3d5f16c11532f6101c3547a843c9016a1b29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57c591ad1d83e9b2cd563ddf979d3d5f16c11532f6101c3547a843c9016a1b29
SHA3-384 hash: 4dfca5d1d2081b2fabeb14b268f98b48efcb2729127076a372ae9e827657922e4008b99f98035f73cbe590fcf2ab6b00
SHA1 hash: 14a856300b75e2f1218e2135c2c0c954bf9d28f7
MD5 hash: 8636da46200432e0a74e241f3392aaa5
humanhash: johnny-bakerloo-enemy-eighteen
File name:SWIFTCOPY.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:151'552 bytes
First seen:2020-05-18 05:50:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 06bab17b05b31c6f5a859b9c9f1c4435 (1 x AveMariaRAT)
ssdeep 3072:JYFWALjXh33cf34kjcBa2NEAhX9SSI0ifVaKGVUmdr:JYFXXtcA+jAplifEK9m
Threatray 435 similar samples on MalwareBazaar
TLSH BCE3E12296542663E19781712E729BFF0235BD36E2040D0363DBFE6D5573A53A2F232B
Reporter cocaman
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Formbook-7783355-0
Create hunting rule

Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/358286
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 06:35:48 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k7czdli5qpu3ftkwhxpzphj5l4lmcfjs6yibynkhvbb4salkdmuq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
07237097ff28d5ca9df13b6fb8021b423335d664bd3b539d00c1542bf032b5b0
AveMariaRAT
4343e77b4710f4ea72e445b733076ba3495be7f1c94b88d73ff70b6f03711c3e
AveMariaRAT
4fe45a8e07fc28eb30222f08219ca2bb8832220a97ff56333193bd422a876f0c
AveMariaRAT
54740b083071363aa774760bd55013cbcc2ee8e856bf8ac97a383601a5bc666e
AveMariaRAT
7a21a7a3639f98f4d6d5f4e838aa26cd26586a06ad9cb580aa5b23c4c8051901
AveMariaRAT
7f29131cb5f28ccbd60dbdf39b6b3c79a974d4a3950aac1d1c0f7edd68193c03
AveMariaRAT
7f62e5e2d0cfbe0740718588465b71a701fe3e188a8a4755baacbdc6fb41d52c
AveMariaRAT
a860b7f6787c55f457249bf722d6ce93034391889c05f6ec0c9e10befe8c8c03
AveMariaRAT
cb5c24e649bfdd00c9d03e8c16dfda3f1101fb531b94fd57922339a12e22a0d6
AveMariaRAT
fe974cd55e593d754c3dca74db62bc2fb48f9144c7098eedcf3b9abad1fe05e2
AveMariaRAT
+ 425 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer rat
Link:
https://tria.ge/reports/201109-f8x7qtsmqj/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Warzone RAT Payload
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_ave_maria_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments