MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d0c5b1a7131a3e3ec0fd0ccff7b97b6edb3dc8c43fed4d3e314a7b866d35325. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d0c5b1a7131a3e3ec0fd0ccff7b97b6edb3dc8c43fed4d3e314a7b866d35325
SHA3-384 hash: 1b1b0145717d3603c4c5003b2701efcc30586899d9482a7edd0c3343606fc6f93e26c15e870e4209cbc83922b2f0bed0
SHA1 hash: ef66773e4fff7959874d23f8fc45304f52075514
MD5 hash: 576041234263955bece7d0ce0b94e782
humanhash: bacon-harry-purple-comet
File name:SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.s.31877.21616
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:568'184 bytes
First seen:2023-02-06 11:19:37 UTC
Last seen:2023-02-06 11:45:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (388 x GuLoader, 59 x RemcosRAT, 44 x VIPKeylogger)
ssdeep 12288:YkygPtf7WQHrxhWfPM+N8v2ocCSivrlicguw9PzcI:gUjWQ1hgPd8vcKGZ7cI
TLSH T1A1C42316676190D2D667A6322AB8B1339F877F3260940F6F67817B907C322D0CC5EB67
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 8ee2f0b8cc3b3b80 (5 x AveMariaRAT, 1 x GuLoader)
Reporter SecuriteInfoCom
Tags:AveMariaRAT exe signed

Code Signing Certificate

Organisation:tessies
Issuer:tessies
Algorithm:sha256WithRSAEncryption
Valid from:2022-04-14T06:49:25Z
Valid to:2025-04-13T06:49:25Z
Serial number: 759e7843d816e563
Thumbprint Algorithm:SHA256
Thumbprint: 8202d9e54d879eb14d14d8d0e56764d3d1c8210b13e4cc4e7bd1953b852b6c6a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.s.31877.21616
Verdict:
Malicious activity
Analysis date:
2023-02-06 11:23:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d1a628ae-a428-4d62-b286-bf3301364f57

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/360809/
Detection(s):
SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.s.31877.21616.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/65728/overview
Behaviour
MalwareBazaar
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63e0e265696b2d9725755c52/reports/f6bf6e76-471d-4f68-af51-058fba8f0145/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/5d0c5b1a7131a3e3ec0fd0ccff7b97b6edb3dc8c43fed4d3e314a7b866d35325
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/28e2e80b-eca9-43e3-b72a-7d10f16c9ace
Result
Threat name:
AveMaria, GuLoader, UACMe
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1166548
Signature
Adds a directory exclusion to Windows Defender
Contains functionality to hide user accounts
Creates files in alternative data streams (ADS)
Drops PE files to the document folder of the user
Drops script or batch files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Malicious sample detected (through community Yara rule)
Sigma detected: Drops script at startup location
Tries to detect Any.run
Yara detected AveMaria stealer
Yara detected GuLoader
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 799319 Sample: SecuriteInfo.com.suspected.... Startdate: 06/02/2023 Architecture: WINDOWS Score: 100 70 googlehosted.l.googleusercontent.com 2->70 72 drive.google.com 2->72 74 doc-08-8g-docs.googleusercontent.com 2->74 80 Malicious sample detected (through community Yara rule) 2->80 82 Yara detected GuLoader 2->82 84 Yara detected UACMe UAC Bypass tool 2->84 86 3 other signatures 2->86 12 SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.s.31877.21616.exe 27 2->12         started        16 Windows.exe 19 2->16         started        signatures3 process4 file5 62 C:\Users\user\AppData\...\CCUpdate.exe, PE32 12->62 dropped 64 C:\Users\user\AppData\Local\...\System.dll, PE32 12->64 dropped 96 Drops PE files to the document folder of the user 12->96 98 Drops script or batch files to the startup folder 12->98 100 Adds a directory exclusion to Windows Defender 12->100 18 SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.s.31877.21616.exe 5 14 12->18         started        66 C:\Users\user\AppData\Local\...\System.dll, PE32 16->66 dropped 102 Tries to detect Any.run 16->102 23 Windows.exe 2 8 16->23         started        signatures6 process7 dnsIp8 76 drive.google.com 142.250.181.238, 443, 49828, 49838 GOOGLEUS United States 18->76 78 googlehosted.l.googleusercontent.com 172.217.16.193, 443, 49829, 49839 GOOGLEUS United States 18->78 52 C:\Users\user\Documents\Windows.exe, PE32 18->52 dropped 54 C:\Users\user\...\Documents:ApplicationData, PE32 18->54 dropped 56 C:\Users\user\...\Windows.exe:Zone.Identifier, ASCII 18->56 dropped 58 2 other malicious files 18->58 dropped 88 Creates files in alternative data streams (ADS) 18->88 90 Adds a directory exclusion to Windows Defender 18->90 92 Tries to detect Any.run 18->92 94 2 other signatures 18->94 25 Windows.exe 19 18->25         started        28 powershell.exe 23 18->28         started        30 cmd.exe 23->30         started        file9 signatures10 process11 file12 60 C:\Users\user\AppData\Local\...\System.dll, PE32 25->60 dropped 32 WerFault.exe 21 16 25->32         started        34 conhost.exe 28->34         started        36 sdclt.exe 30->36         started        38 conhost.exe 30->38         started        40 sdclt.exe 30->40         started        42 sdclt.exe 30->42         started        process13 process14 44 control.exe 36->44         started        process15 46 Windows.exe 44->46         started        file16 68 C:\Users\user\AppData\Local\...\System.dll, PE32 46->68 dropped 104 Tries to detect Any.run 46->104 50 Windows.exe 46->50         started        signatures17 process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d0c5b1a7131a3e3ec0fd0ccff7b97b6edb3dc8c43fed4d3e314a7b866d35325/
Threat name:
Win32.Trojan.Warzonerat
Create hunting rule
Status:
Malicious
First seen:
2023-02-06 11:20:10 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lugfwgtrggr6h3ap2dgp664xw3w3hxemip7nju7dcst3qzwtkmsq._file
Verdict:
suspicious
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:warzonerat downloader infostealer persistence rat
Link:
https://tria.ge/reports/230206-nfezlsgh9z/
Behaviour
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Drops startup file
Executes dropped EXE
Loads dropped DLL
Guloader,Cloudeye
WarzoneRat, AveMaria
Unpacked files
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/4ed07251-59b0-4867-87af-397826b8db42/
SH256 hash:
194f9df745d5146d334b0e7c8e4afef13cff0f02da3f68bcee8845d26bedb037
MD5 hash:
fd4bc4a2c95d26f61ecb26672415221f
SHA1 hash:
ef1f60af264a21b191beaf2c5ca0204630f1dd1c
Link:
https://www.unpac.me/results/4ed07251-59b0-4867-87af-397826b8db42/
SH256 hash:
5d0c5b1a7131a3e3ec0fd0ccff7b97b6edb3dc8c43fed4d3e314a7b866d35325
MD5 hash:
576041234263955bece7d0ce0b94e782
SHA1 hash:
ef66773e4fff7959874d23f8fc45304f52075514
Link:
https://www.unpac.me/results/4ed07251-59b0-4867-87af-397826b8db42/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d0c5b1a7131a3e3ec0fd0ccff7b97b6edb3dc8c43fed4d3e314a7b866d35325

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/360809/

Comments