MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d851e2ff271cd6f2ab15ced29dd630c2930b2069410a138f566229680066b37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d851e2ff271cd6f2ab15ced29dd630c2930b2069410a138f566229680066b37
SHA3-384 hash: d684867dd446833d6c1ebd681bdd32319c8eb5d3fe451f248cb336c0dfc42a418080dabc7d8c688d47e0ffae0b0e0feb
SHA1 hash: a27129f705172548f9629de1b8db816f5bdf9e42
MD5 hash: e09ea6245a6a64100786fbe1f5434e15
humanhash: six-pluto-pizza-yellow
File name:IMG2_455982134.rar
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:7'708 bytes
First seen:2022-05-04 13:09:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 192:ryvIgu0PRqqt1imxfWM3gkJ+ZBPtpUBNCwzfMzZ1fW:rdoR5iQft3gkJEBPyKzW
TLSH T133F1AEBC1AD47E65CBAE28D9984C138069014B01DF572EFCEBDE4E1A78143B6CE56607
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "info@trademeetals.club" (likely spoofed)
Received: "from box0.trademeetals.club (box0.trademeetals.club [62.197.136.173]) "
Date: "4 May 2022 15:59:52 +0300"
Subject: "I.N.T New Project Order"
Attachment: "IMG2_455982134.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/62727b2fa796b1934807cec7/reports/b433315b-8575-4e3a-8d80-040d8f0dd968/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d851e2ff271cd6f2ab15ced29dd630c2930b2069410a138f566229680066b37/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-05-04 13:10:06 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
10 of 42 (23.81%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lwcr4l7sohgw6kvrltwstxldbqutbmqgsqikcohvmyrjnaagnm3q._file
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat collection infostealer rat spyware stealer
Link:
https://tria.ge/reports/220504-qec5qsgdhl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Warzone RAT Payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
185.140.53.174:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/5d851e2ff271cd6f2ab15ced29dd630c2930b2069410a138f566229680066b37

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 5d851e2ff271cd6f2ab15ced29dd630c2930b2069410a138f566229680066b37

(this sample)

AveMariaRAT

Executable exe e4618a3bbb124103079e858dcc0e1eedee94a58cac59fc57fd4404cd77690b77

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4618a3bbb124103079e858dcc0e1eedee94a58cac59fc57fd4404cd77690b77
  
Dropping
MD5 54365eeb9a129749d06844f24b8b704c

Comments