MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67dda85b8fcccfa131d203c066116de63e431fd9d2b2cb4651260f426a0d24de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 16 File information Comments

SHA256 hash:	67dda85b8fcccfa131d203c066116de63e431fd9d2b2cb4651260f426a0d24de
SHA3-384 hash:	8cb88eed5e9a70d0815ed48e0110c100bf6e386723b04a948e820fba9b59b2dfb31e97c64dfc04c1d68c3fe7f23ef757
SHA1 hash:	2a429da20afbc5dc6e21b681fd4d89384caa310b
MD5 hash:	6c3e20f16bb359fb22557004478366f9
humanhash:	indigo-tennis-green-oregon
File name:	TT PYMENT COPY.zip
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	20'531 bytes
First seen:	2024-04-30 07:47:50 UTC
Last seen:	2024-04-30 09:37:00 UTC
File type:	zip
MIME type:	application/zip
ssdeep	384:4+KwQBnfS5PBpXlb5P3L34qjPvx2FILv1A0L8UlkwdPecZO0ZYU8oPa7+l:MJN65PrztR8ILiY8UlPJvZO6YU1Pbl
TLSH	T1A192E16E578684EE408A77F3AC1B6596D47D982E6660351C17FE76E03E4E3542838930
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AveMariaRAT zip

cocaman

Malicious email (T1566.001)
From: ""Mohammed Igbal Ghazi" <fts@americansparts.com>" (likely spoofed)
Received: "from mta0.americansparts.com (mta0.americansparts.com [91.193.19.79]) "
Date: "Tue, 30 Apr 2024 07:16:20 +0000"
Subject: "RE:New M.Igbal Cont.co Order 330575"
Attachment: "TT PYMENT COPY.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

386

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	TT PYMENT COPY.doc
File size:	72'192 bytes
SHA256 hash:	7fb4306a36b61be977dfc6f56443542c9d70273bb97b55d5049cd86608aa0f68
MD5 hash:	1812b0ee6924f6188269c65494e580e8
MIME type:	application/msword
Signature	AveMariaRAT

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilDoc.AutoTriggerEvilMrFantasyM3.20200721.UNOFFICIAL

TwinWave.EvilDoc.DOCXSTRGOOD._IEX.210408.UNOFFICIAL

TwinWave.EvilDoc.TastesLikeVenom20230822.UNOFFICIAL

Result

Verdict:

Malicious

File Type:

Legacy Word File with Macro

Link:

https://app.docguard.net/67dda85b8fcccfa131d203c066116de63e431fd9d2b2cb4651260f426a0d24de/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

macros macros-on-open powershell

Link:

https://www.filescan.io/uploads/6630a23e75339da04fa779b3/reports/8e5582cc-b6fe-472e-9fd7-f3d6643c4e45/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/67dda85b8fcccfa131d203c066116de63e431fd9d2b2cb4651260f426a0d24de

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/67dda85b8fcccfa131d203c066116de63e431fd9d2b2cb4651260f426a0d24de/

Threat name:

Win32.Trojan.Znyonm

Status:

Malicious

First seen:

2024-04-30 07:47:53 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

10 of 38 (26.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m7o2qw4pzth2cmosapagmeln4y7egh6z2kzmwrsreyhue2qnetpa._file

Result

Malware family:

n/a

Score:

10/10

Tags:

macro macro_on_action

Link:

https://tria.ge/reports/240430-k2rczsha9x/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Drops file in Windows directory

Process spawned unexpected child process

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/67dda85b8fcccfa131d203c066116de63e431fd9d2b2cb4651260f426a0d24de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_OLE_file_magic_number Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	Office_AutoOpen_Macro Create hunting rule
Author:	Florian Roth
Description:	Detects an Microsoft Office file that contains the AutoOpen Macro function

Rule name:	Office_AutoOpen_Macro Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an Microsoft Office file that contains the AutoOpen Macro function

Rule name:	office_document_vba Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	Office document with embedded VBA
Reference:	https://github.com/jipegit/

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	reverse_http Create hunting rule
Author:	CD_R0M_
Description:	Identify strings with http reversed (ptth)

Rule name:	TA505_Maldoc_21Nov_2 Create hunting rule
Author:	Arkbird_SOLG
Description:	invitation (1).xls
Reference:	https://twitter.com/58_158_177_102/status/1197432303057637377