MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a0075d93fec0997f74906d3843bdaa763ec60b88bb4ea17f19c210c411598a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a0075d93fec0997f74906d3843bdaa763ec60b88bb4ea17f19c210c411598a9
SHA3-384 hash: e195dd457e7553f963063da7a3397b4d0f2ee35a97d82273131aedfed3ab8c36c1ef070d69b7c45b74b77b990fef7838
SHA1 hash: 0b3cfda64c6897b39947d6cd962dcfa412a22176
MD5 hash: ad0516ffefe7aa4de39f498af33dc4d6
humanhash: minnesota-oven-muppet-charlie
File name:PO_402114 doc.com
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:450'560 bytes
First seen:2021-05-20 17:50:48 UTC
Last seen:2021-05-20 18:08:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:dsAgFyPfSuVya+NXMLWRmvoRgETQE/kwrOKz:unFytCciR5N1Hz
Threatray 853 similar samples on MalwareBazaar
TLSH 1CA412112318EB59F57E77BCB428D12003F0781CEB21EB5DAF5A117E06D3B8B47A9A52
Reporter abuse_ch
Tags:AveMariaRAT com RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/160251/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.747-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6a0075d93fec0997f74906d3843bdaa763ec60b88bb4ea17f19c210c411598a9/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2021-05-20 17:51:21 UTC
AV detection:
4 of 47 (8.51%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=niahlwj75qezp52ja3jyio62u5r6yyfyro2ouf7rtqqqyqivtcuq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0dc8b267631d1894fbc6644468e5a9d9b9543257e0a85c271af230c757831496
AveMariaRAT
1967e0a5da88244c0b9ce1c35f7df573c1004947ea5b39f94cd45176ea940894
AveMariaRAT
23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b
AveMariaRAT
5ba2e4021682f2700ca05c93eb32efb3c93d7bebd816842bdcca6cc768771cbe
AveMariaRAT
6c19d7e749c5fb3b7dee5906be8a944b52352ccaf7fc4970caf58769988874f6
AveMariaRAT
7ee0c62e76613b5cdf12f2fa8d408ba952d9ac828e97d65411f8e9f8619cfc6b
AveMariaRAT
8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb
AveMariaRAT
890407f2497d9d1d7fbe7f5f823438821b458cf8f5e62eb7f0e3220c342cd68b
AveMariaRAT
8ad1ee75b0e6ad7140aed361cc0000ff540f01fc4e63591a64ccbeedc31dcaa8
AveMariaRAT
a5c4e0a33316630d870175895153a056499950d478b2d09491f335ecfaaa4e3d
AveMariaRAT
+ 843 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer rat spyware stealer
Link:
https://tria.ge/reports/210520-7hg793wlls/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Warzone RAT Payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
185.140.53.69:4080
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe 6a0075d93fec0997f74906d3843bdaa763ec60b88bb4ea17f19c210c411598a9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/160251/

Comments