MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 628112309eda8a42f02e93410036f25cf3b0f77cb00205e276159ade56870367. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 628112309eda8a42f02e93410036f25cf3b0f77cb00205e276159ade56870367
SHA3-384 hash: 6a4c39cac419c0bef1e2bf3cb9b525c508c54fa48cff199e8dc6b132eb8b831af9f3ee7a47e9afb62f894ebb41db63a2
SHA1 hash: 70b4ab2db723ff3d572c4c3b52db49e5b3ed3bb0
MD5 hash: 3fe01cb5d399deb9428cb05f4dc40210
humanhash: fourteen-mountain-nitrogen-montana
File name:PO90841.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:975'872 bytes
First seen:2020-06-29 12:59:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:rAHnh+eWsN3skA4RV1Hom2KXMmHa6N8T/Rb5:Gh+ZkldoPK8Yad/j
Threatray 1'195 similar samples on MalwareBazaar
TLSH 35257C127391C025FFAA9273DB15F2F556BC7D25C523842F22983DBBB9701B1222E663
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: mail.strong-bot.com
Sending IP: 95.216.22.157
From: Regina Brueck<regina@tel-conn.com>
Reply-To: Regina Brueck<webupdate90393@protonmail.com>
Subject: Fwd: EFT Foreign Remittance Advice
Attachment: PO90481.IMG (contains "PO90841.exe")

AveMariaRAT payload URL:
http://193.56.29.251/service/PO90841.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/16308/
Detection(s):
Win.Downloader.Autoit-6912272-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/628112309eda8a42f02e93410036f25cf3b0f77cb00205e276159ade56870367/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 13:01:04 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mkareme63kfef4bosnaqanxsltz3b534wabalytwcwnn4vuhantq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
23ef17c8a9fbcb6c35549aff9263566bec6e3fbc61e6bdfb9715d2595a1ee003
AveMariaRAT
3b2850cd8a54bfdb4c52c45f541c4d97047a28b19d034bbec609389b19019094
AveMariaRAT
788439bb46a147272e39cdd6a8a8ecdc68dbb3317e4d058526d6feda09d64613
AveMariaRAT
89ceb49c67e4f8f715b9eef4ad2b1fcac135da2560072c5f3449273f08a7f7bb
AveMariaRAT
a38f26190f844b13a2bbb8cbecf4b57bf109f78b665e34b8164882d8d2cdb6ee
AveMariaRAT
b254d7faa603b46c4c63f6d1f88d65767fb80638a000967fe527b9572b956e35
AveMariaRAT
bcc007773b48459b0b8b0fc4c47d621f65a178d297517486f78aec91d5dc1a87
AveMariaRAT
c1f0ba6302099b8f7ef1ce28a333764efdd308cccc761ba4fcef2af386f13090
AveMariaRAT
e0304dda8c6bcd6e6987441aab472a1bdaf17efb0ef9906b15c33fb59042e257
AveMariaRAT
e942c853f791a2ebd37ae59344bf8878d9a02cdcb83848a68876c49497c642d2
AveMariaRAT
+ 1'185 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion spyware trojan
Link:
https://tria.ge/reports/200629-52grj3wksa/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Modifies system certificate store
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

81dfb10ba80f4ecebec700709d1ac043

AveMariaRAT

Executable exe 628112309eda8a42f02e93410036f25cf3b0f77cb00205e276159ade56870367

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/403279/
  
Dropped by
MD5 81dfb10ba80f4ecebec700709d1ac043
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/16308/

Comments