MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b84733e089f51187e8652511afffd0b235ecf6bbbb254c21e2d8f671f0ed895. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 5 File information Comments

SHA256 hash:	6b84733e089f51187e8652511afffd0b235ecf6bbbb254c21e2d8f671f0ed895
SHA3-384 hash:	bd959e8fe4a029b09d5b420138d77e767b49c5080c348855f069d21e0d5932152c8b6838d837d6c6efdbe75a6ddfc2bb
SHA1 hash:	d5d1188f12f36bfbd7fb80866b7b9a330821a725
MD5 hash:	116017bc96bcf2c831f7bd597103e727
humanhash:	london-uranus-fish-may
File name:	New Order 8399040.exe
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	825'344 bytes
First seen:	2020-07-02 07:14:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6f4a5db2ce2ae19074b0e088a68b6a05 (4 x AveMariaRAT, 1 x LuminosityLink)
ssdeep	12288:I2TpWuXJM6iiguuUyREh6ZCjdJ2oQZ1DakzZwP2Ij:IopW+JMjNZCjXzQZ1DakFW
Threatray	428 similar samples on MalwareBazaar
TLSH	76051854A3A0C038FAB72AF156FE117D947E7AD11B28A0C752D01DEE5A26AF1EC30717
Reporter	abuse_ch
Tags:	AveMariaRAT exe nVpn Outlook RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: APC01-PU1-obe.outbound.protection.outlook.com
Sending IP: 40.92.254.108
From: 孔德刚 <kong-degang@hotmail.com>
Subject: purchase order
Attachment: New Order 8399040.xz (contains "New Order 8399040.exe")

AveMariaRAT C2:
185.140.53.48:5401

Hosted on nVpn:
% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

WarzoneRAT

Link:

https://www.capesandbox.com/analysis/18349/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

PUA.Win.Adware.Domaiq-6840275-0

Detection:

avemaria

Link:

https://mwdb.cert.pl/sample/6b84733e089f51187e8652511afffd0b235ecf6bbbb254c21e2d8f671f0ed895/

Threat name:

Win32.Trojan.Avemariarat

Status:

Malicious

First seen:

2020-07-02 07:16:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 27 (85.19%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nochgpqit5irq7ugkjirv775bmrv5t3lxozfjqq6fwhwohyo3ckq._file

Verdict:

malicious

Label(s):

avemaria

AveMariaRAT

0f9ddf646fdc47eb56e61b8d249fadeb1f7fa0c031ea3a8668ec040d6c6fa803

AveMariaRAT

24bce555546817dc9293da3c7fe25301777f365e008ef2cdd3d979c829287ec6

AveMariaRAT

3ac41aaeb5772f77fa5e3c6bfaeecc906430b37abb0b7d3be40adc87b0d57e1d

AveMariaRAT

4cffbdf1d3e2016475da67b15f0ab12a9658e0970f691cebe0bd161e2e1772b2

AveMariaRAT

a788ea8c9c5bbe20b11f00d99f49c22656f0f2f8456f085d206ba770b4649938

AveMariaRAT

ae64e86e27b074ef0869d747916c9056b5e180f37f80624019d993f2b744dd35

AveMariaRAT

b5279796301bec9d8b3de84dff29a98dfb7cfe9d549279fddfd624b61583960f

AveMariaRAT

d7a9047d6d19050866c5b5c7d08f4b45208d9b2a2a4f4179cadaf37ea92cfa89

AveMariaRAT

d996151f4cb4abfd48fb856239ea0e2cc54ba89954586aa07a67135a0e15ad8a

AveMariaRAT

+ 418 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/200702-glxr1a9evn/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Suspicious use of WriteProcessMemory

Adds Run entry to start application

Loads dropped DLL

Drops startup file

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	win_ave_maria_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator