MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 639ceb5aeeb014d92a19a24bd1a56c782c4d0b150dfe21b1d340222fc1060bbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 7 File information Comments

SHA256 hash:	639ceb5aeeb014d92a19a24bd1a56c782c4d0b150dfe21b1d340222fc1060bbf
SHA3-384 hash:	9e6443958319b9f72ab6ace825171df95417b88afbf1370b40a05ceddee8a06571cbaf8a757841c434818afaef86d81f
SHA1 hash:	8f227504a148c356874c58ca97bb7fcaab7d240d
MD5 hash:	475fb3ccd479388d2106422587e42350
humanhash:	texas-robert-burger-victor
File name:	639ceb5aeeb014d92a19a24bd1a56c782c4d0b150dfe21b1d340222fc1060bbf
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	3'024'699 bytes
First seen:	2020-11-07 17:38:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	676f4bc1db7fb9f072b157186a10179e (1'400 x AveMariaRAT, 37 x Riskware.Generic, 2 x njrat)
ssdeep	24576:05O7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHu:05O7AAmw4gxeOw46fUbNecCCFbNec1
Threatray	3'172 similar samples on MalwareBazaar
TLSH	72E5BFC5766D084BF32219BA651F8121A148BC6B9304B71B6B7E390FD4872CAF5E374B
Reporter	seifreed
Tags:	AveMariaRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Running batch commands

Creating a process with a hidden window

Forced system process termination

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a file in the Windows subdirectories

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Forced shutdown of a system process

Creating a file in the mass storage device

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/639ceb5aeeb014d92a19a24bd1a56c782c4d0b150dfe21b1d340222fc1060bbf/

Threat name:

Win32.Spyware.AveMaria

Status:

Malicious

First seen:

2020-11-07 17:45:27 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mooowwxowaknskqzujf5djlmpawe2cyvbx7cdmotiarc7qigbo7q._file

Verdict:

unknown

AveMariaRAT

09a3aa26ef9c6f2544fd2377df9ddb4ed2462db3206cc7723f5015a8e62bde2e

AveMariaRAT

12c0aac78e35536d75940c301e62cb8cb0388f4e43cf9f1925e02a66cbe2a319

AveMariaRAT

1b7544a23889922c4262251462e81dc2c6d481f1b6c5164a82e4ea5b2b31ff91

AveMariaRAT

3772ad390ed9afe00625633bcc8b4ef9a3cc4ebd3afcdd17e5bcbc77d6dcf450

AveMariaRAT

5b21a4372a66f1bb75eb6edb0666d123fab94c98a170cceb3df8554038eb50f5

AveMariaRAT

614ef9ec888de4d04f0624fd4a65f1965313c03592dfe7565d463859ce7122b0

AveMariaRAT

9a7cd11337369984d415dd2f6853c865b73210272430723f2eb4bbbe41a9034a

AveMariaRAT

cc07bcb41bac2d36932375e5be5c4c1b52e147ba3b3c585d5c2435cc0471308d

AveMariaRAT

d4577b6598fbbf11cfa28b876e1bcb6eaaaa256a8a3f1e82a88ae561854da9ad

AveMariaRAT

+ 3'162 additional samples on MalwareBazaar

Result

Malware family:

warzonerat

Score:

10/10

Tags:

family:warzonerat evasion infostealer persistence rat upx

Link:

https://tria.ge/reports/201108-9hae4by95n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Suspicious use of SetThreadContext

Adds Run key to start application

Drops startup file

Loads dropped DLL

Executes dropped EXE

Modifies Installed Components in the registry

UPX packed file

Warzone RAT Payload

Modifies WinLogon for persistence

Modifies visiblity of hidden/system files in Explorer

WarzoneRat, AveMaria

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ave_maria_warzone_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	RDPWrap Create hunting rule
Author:	@bartblaze
Description:	Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:	https://github.com/stascorp/rdpwrap

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample