MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d59e992902a831d4c7a16213cd940ae06d597feedddc2aa011ea85ffc1e32b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d59e992902a831d4c7a16213cd940ae06d597feedddc2aa011ea85ffc1e32b9
SHA3-384 hash: dcfe6ba0bd628205dea16a1a05e470893cb0a82b31de2b00e6c3ebf0a12d19add44241fc93f841741d33113c4e46110e
SHA1 hash: 4c40e89b34fd020e63f409c7d623ae60d3cbfe09
MD5 hash: 6324685e4150d13cfe9f2b0b069cc29c
humanhash: johnny-artist-twelve-maine
File name:6d59e992902a831d4c7a16213cd940ae06d597feedddc2aa011ea85ffc1e32b9
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:104'064 bytes
First seen:2020-06-29 07:45:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 879635b629affd65258851469f9bf6f9 (31 x AveMariaRAT)
ssdeep 1536:uvqIPE8ddFD1frrq7gVxoNGPNJKF1m+xVE0/bK/Y:7I8CxFVxAMNJKu+xVE0TK/Y
Threatray 424 similar samples on MalwareBazaar
TLSH 65A39D2377D14439F67102B02CB97F79CABFFE380221855BD72456876B31994EA263A3
Reporter JAMESWT_WT
Tags:AveMariaRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15907/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Maria.4.17072.22484.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Maria.3.30306.22950.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d59e992902a831d4c7a16213cd940ae06d597feedddc2aa011ea85ffc1e32b9/
Threat name:
Win32.Trojan.WarzoneRAT
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 21:38:00 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nvm6teuqfkbr2td2cyqtzwkavydnlf765xo4fkqbd2uf77a6gk4q._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
54740b083071363aa774760bd55013cbcc2ee8e856bf8ac97a383601a5bc666e
AveMariaRAT
6e7cb3410b7189f1334bea37863662a29aedf4a504175127075fb85fd0e03ee9
AveMariaRAT
7b7b7e7ad9b106a5508583f1b60e3a3d7385bf0d6592ca816839f6633f5e8045
AveMariaRAT
8fbd0e656a1ee90b82591111e01fb0e8b7a3d3e711e0d5165d05a5d844b8c03f
AveMariaRAT
9c62d911a4efd2a37364d26439085d493ca2ab7e4b0fa90ba2f5d937e99e5bdf
AveMariaRAT
9ce5eb576c72ecc29eabbbece917f1873bf4f5782485b22549dfbb6ff1d56f58
AveMariaRAT
a860b7f6787c55f457249bf722d6ce93034391889c05f6ec0c9e10befe8c8c03
AveMariaRAT
aa1de2e65be7572bdcc37b22c2c2f9be31ee5920d41174bfd18b2c2b7fabc6b9
AveMariaRAT
ac0aacc526d6b71995cdc6b64bb66a727a92acc4cd2869e9abcfc16dfee8189f
AveMariaRAT
b38f7cacc56a97f122827cc2e89c55c9747ad790f7649b6078cedca83659b4dc
AveMariaRAT
+ 414 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-lc2b7g82tx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15907/

Comments