MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d393a34a6faf41a81f32a8866ef2468cedf9912b9df8fab2970361b030da87a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d393a34a6faf41a81f32a8866ef2468cedf9912b9df8fab2970361b030da87a
SHA3-384 hash: f9e0c2fd77bc5b147c49b1afcfdf65a7debe853c6e75f8e4c49a06abd256ab24f1c64a2d02949c8faf622bd42276a7ce
SHA1 hash: 84b3db9b1ff33ade60a109f50c9a294a320913e7
MD5 hash: 8b42ea4894ab2cbae9f9810d43833e82
humanhash: table-beryllium-table-oscar
File name:IMG_P_O_RFQ-WSB_17025-ENd User-Evaluate.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'396'392 bytes
First seen:2020-11-11 14:28:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3b4a52a08bd0152d124fdb84d8fb3e25 (2 x AveMariaRAT, 1 x ModiLoader)
ssdeep 24576:UK4m11JLIU2GlCPaWlPhgTWR7hJm2jr4H1YY/YX:flN2PDmOTp
Threatray 1'017 similar samples on MalwareBazaar
TLSH A555AFE2A7800933F122DA7CCD7B9FE75935BD213D2888A73AF86C5C1E766417419293
Reporter James_inthe_box
Tags:AveMariaRAT exe

Code Signing Certificate

Organisation:Microsoft Time-Stamp Service
Issuer:Microsoft Time-Stamp PCA
Algorithm:sha1WithRSAEncryption
Valid from:Sep 7 17:58:56 2016 GMT
Valid to:Sep 7 17:58:56 2018 GMT
Serial number: 33000000CCCBB813EB5D722D450000000000CC
Intelligence: 15 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 0C043752471269029D69B98BD42DFAD2656F1BCFDEC9A291039F4EF69B496C70
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20201111-0907.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Changing a file
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% directory
Deleting a recently created file
Reading critical registry keys
Creating a file in the %temp% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Stealing user critical data
Result
Gathering data
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/530308
Signature
Allocates memory in foreign processes
Contains functionality to hide user accounts
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 314255 Sample: IMG_P_O_RFQ-WSB_17025-ENd U... Startdate: 11/11/2020 Architecture: WINDOWS Score: 100 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected AveMaria stealer 2->43 45 2 other signatures 2->45 6 IMG_P_O_RFQ-WSB_17025-ENd User-Evaluate.exe 2 24 2->6         started        11 Alzrdrv.exe 22 2->11         started        13 Alzrdrv.exe 21 2->13         started        process3 dnsIp4 25 cdn.discordapp.com 162.159.130.233, 443, 49742 CLOUDFLARENETUS United States 6->25 23 C:\Users\user\AppData\Local\...\Alzrdrv.exe, PE32 6->23 dropped 47 Writes to foreign memory regions 6->47 49 Allocates memory in foreign processes 6->49 51 Creates a thread in another existing process (thread injection) 6->51 15 ieinstal.exe 3 4 6->15         started        27 162.159.129.233, 443, 49752, 49763 CLOUDFLARENETUS United States 11->27 53 Multi AV Scanner detection for dropped file 11->53 55 Injects a PE file into a foreign processes 11->55 19 ieinstal.exe 1 11->19         started        21 ieinstal.exe 1 13->21         started        file5 signatures6 process7 dnsIp8 29 tulick.hopto.org 54.39.198.228, 4902, 49750 OVHFR Canada 15->29 31 Tries to steal Mail credentials (via file access) 15->31 33 Tries to harvest and steal browser information (history, passwords, etc) 15->33 35 Increases the number of concurrent connection per server for Internet Explorer 15->35 37 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->37 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d393a34a6faf41a81f32a8866ef2468cedf9912b9df8fab2970361b030da87a/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 04:40:52 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0629278e51106220eb8727f80f4c24cfb432e6344561e8518030b19b669bcc72
AveMariaRAT
2cc5a802aaf99da12f98c79d28f14a2e850b9a9afc4c0f682430a425643d8cda
AveMariaRAT
4e420c5efeb26330ec4eb618426d859222b791798df3ae65c59fc20ef2f2889a
AveMariaRAT
52e8ebb47ae631081c6ac0ab78219951e8c7ac540e11b420e92d5df89ea719d7
AveMariaRAT
97b34cb713e879fb7cfe158a3180b73d1c71b71446368f242a0c004d0c3462dd
AveMariaRAT
9f5afe868a8dd23926e807303d8896b239b802a3c366e448f4c59a103540019f
AveMariaRAT
af84cf642737e0b62537d9a78861cc129fbc0e68a34770cb70c6ccaa3f553687
AveMariaRAT
b98f29a897354964b324ad55f046ae324f4f43efe17abdfbbfd726792ec3c763
AveMariaRAT
e0e3ae47b7e48c3c81724d0a63f5f6f8033bb516d97c538ea52349a102a0e1b6
AveMariaRAT
f6878003c470e531787cd70fc0785bb01a5c64d6a39f0efec5aabc5ac3f5f889
AveMariaRAT
+ 1'007 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:warzonerat infostealer persistence rat spyware trojan
Link:
https://tria.ge/reports/201111-mp7f81hhg6/
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
JavaScript code in executable
Loads dropped DLL
Reads user/profile data of web browsers
ModiLoader First Stage
ModiLoader Second Stage
Warzone RAT Payload
ModiLoader, DBatLoader
WarzoneRat, AveMaria
Unpacked files
SH256 hash:
5d393a34a6faf41a81f32a8866ef2468cedf9912b9df8fab2970361b030da87a
MD5 hash:
8b42ea4894ab2cbae9f9810d43833e82
SHA1 hash:
84b3db9b1ff33ade60a109f50c9a294a320913e7
Link:
https://www.unpac.me/results/fb11a82d-cc75-4b9c-9e5d-fc3006601243/
SH256 hash:
b3660a846999e94b5f066c22442685580de4c167146064b0db3bad919c6d30e5
MD5 hash:
458c61e6d2b5dd217567f8e23e40077f
SHA1 hash:
0764e66e290f340ebfc2ae9d487a8f8df5636804
Link:
https://www.unpac.me/results/fb11a82d-cc75-4b9c-9e5d-fc3006601243/
SH256 hash:
8c79008d2ae643e31ef03445a9a02b9ac97cfa0e77329311bd938d0f30c75b24
MD5 hash:
b0a215b69e01dff746fef7d51a92cadf
SHA1 hash:
cc857f411df20f953b5a524a923b352295666f45
Link:
https://www.unpac.me/results/fb11a82d-cc75-4b9c-9e5d-fc3006601243/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments