MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef
SHA3-384 hash: 00f23a85b6012075fe062af90f6524867d4c9046d5dc76f4ca0bf3ec8bcc9f6ee8a1ac2c7b64681d993b2582ef8d6c04
SHA1 hash: 50de550e205b82e095610e9f552e8bc46f3e16e6
MD5 hash: 379d19e542b906f722b3eaf389cf494d
humanhash: golf-march-four-papa
File name:TNT Import Invoice 11-02-23·pdf.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:434'032 bytes
First seen:2023-02-12 14:34:51 UTC
Last seen:2023-02-20 08:45:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (300 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 12288:G/ROa54qs5gy35edFxF1/uz64GIxSvYHV:65fZyEFFsz64GRv+
Threatray 18'416 similar samples on MalwareBazaar
TLSH T16794F1947AA16447D89ABBB55AB7F33C9136AB543A8707077331372D2F32794BE402C2
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 62609cdac9c282e8 (1 x RemcosRAT, 1 x AveMariaRAT)
Reporter abuse_ch
Tags:AveMariaRAT exe signed TNT

Code Signing Certificate

Organisation:Bunco
Issuer:Bunco
Algorithm:sha256WithRSAEncryption
Valid from:2022-11-30T10:40:35Z
Valid to:2025-11-29T10:40:35Z
Serial number: 5555344e6fb9b3e4
Thumbprint Algorithm:SHA256
Thumbprint: c00eb7eec6185fdf272e811ab1a1cd4857fda3c8947f82ae9ce78c4cbf1d871a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
4
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TNT Import Invoice 11-02-23·pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-02-12 14:37:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1ed8c1df-a396-4909-80cd-23a267a93aa2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/364469/
Detection(s):
SecuriteInfo.com.Variant.Jaik.118202.18953.17644.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file
Delayed reading of the file
Creating a file in the %temp% subdirectories
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/68563/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer guloader
Link:
https://www.filescan.io/uploads/63e8f91855a8f3b96191629c/reports/b954dbb9-368e-4856-92d2-8b72b3e45429/overview
Verdict:
Malicious
Labled as:
Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a39cea0c-c998-4a1f-8d70-3c64cca97b1a
Result
Threat name:
AveMaria, GuLoader, UACMe
Create hunting rule
Detection:
malicious
Classification:
phis.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1172619
Signature
Adds a directory exclusion to Windows Defender
Contains functionality to hide user accounts
Creates files in alternative data streams (ADS)
Drops PE files to the document folder of the user
Drops script or batch files to the startup folder
Executable has a suspicious name (potential lure to open the executable)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Tries to detect Any.run
Yara detected AveMaria stealer
Yara detected GuLoader
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 805409 Sample: TNT Import Invoice 11-02-23... Startdate: 12/02/2023 Architecture: WINDOWS Score: 100 72 googlehosted.l.googleusercontent.com 2->72 74 drive.google.com 2->74 76 doc-0k-4o-docs.googleusercontent.com 2->76 86 Malicious sample detected (through community Yara rule) 2->86 88 Multi AV Scanner detection for dropped file 2->88 90 Multi AV Scanner detection for submitted file 2->90 92 10 other signatures 2->92 12 TNT Import Invoice 11-02-23#U00b7pdf.exe 27 2->12         started        16 Windows8.exe 15 2->16         started        signatures3 process4 file5 66 C:\Users\user\AppData\Local\...\System.dll, PE32 12->66 dropped 104 Tries to detect Any.run 12->104 18 TNT Import Invoice 11-02-23#U00b7pdf.exe 5 14 12->18         started        68 C:\Users\user\AppData\Local\...\System.dll, PE32 16->68 dropped 23 Windows8.exe 2 8 16->23         started        signatures6 process7 dnsIp8 78 drive.google.com 142.250.181.238, 443, 49842 GOOGLEUS United States 18->78 80 googlehosted.l.googleusercontent.com 172.217.18.97, 443, 49843, 49856 GOOGLEUS United States 18->80 56 C:\Users\user\Documents\Windows8.exe, PE32 18->56 dropped 58 C:\Users\user\...\Documents:ApplicationData, PE32 18->58 dropped 60 C:\Users\...\Windows8.exe:Zone.Identifier, ASCII 18->60 dropped 62 2 other malicious files 18->62 dropped 94 Creates files in alternative data streams (ADS) 18->94 96 Adds a directory exclusion to Windows Defender 18->96 98 Tries to detect Any.run 18->98 100 2 other signatures 18->100 25 Windows8.exe 15 18->25         started        29 powershell.exe 23 18->29         started        82 142.250.185.238, 443, 49855 GOOGLEUS United States 23->82 31 cmd.exe 23->31         started        file9 signatures10 process11 file12 64 C:\Users\user\AppData\Local\...\System.dll, PE32 25->64 dropped 102 Multi AV Scanner detection for dropped file 25->102 33 WerFault.exe 21 16 25->33         started        36 conhost.exe 29->36         started        38 sdclt.exe 31->38         started        40 conhost.exe 31->40         started        42 sdclt.exe 31->42         started        44 sdclt.exe 31->44         started        signatures13 process14 dnsIp15 70 192.168.11.1 unknown unknown 33->70 46 control.exe 38->46         started        process16 process17 48 Windows8.exe 46->48         started        file18 54 C:\Users\user\AppData\Local\...\System.dll, PE32 48->54 dropped 84 Tries to detect Any.run 48->84 52 Windows8.exe 48->52         started        signatures19 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-02-11 12:43:22 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oi77s7tflh3fldbirstjhcmfskrbvkziyabyqpfbhoawm7l6hlxq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
200f037c6b5ea5be4526e928cd5aa0dbc5d7f6ab48f446cdff0ff07fed2db738
AveMariaRAT
2b149dcd04567baf7d2a123c40592ef90e7c8fde16a38ab164322da5e0c27be2
AveMariaRAT
4f93f4cec712117b9e8bd20f079e8086b6358f0d0b2738a8a448dbdf9fc3db3c
AveMariaRAT
5a70453a6b4f6a5dfd956507dcb364fa07bd6517f87ee23ed6d703f7ec1f6599
AveMariaRAT
957354af4cd0c5869354b87ed9df4166ef66b804e52e2cdffcba8920ada612ea
AveMariaRAT
99d7076ecdb6a3ac9bc89ebae32af757b66c27c4608d31f1c9cf1d4c0492ba04
AveMariaRAT
a43a0cacbfaf5aa649acc0d29ce25855ea92c50af2729f30c5f2ecfad376ef4d
AveMariaRAT
bf912369b12b08acbb2d3641eef6ae1f774a7831be99805a37be7b1a3ad1db3f
AveMariaRAT
ef56f8c0615d059de3d0f669b651d38caf535155878ff4bc7d1b1a62abd45213
AveMariaRAT
+ 18'406 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230212-rx15ysef33/
Behaviour
Enumerates physical storage devices
Loads dropped DLL
Unpacked files
SH256 hash:
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 hash:
3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 hash:
fe582246792774c2c9dd15639ffa0aca90d6fd0b
Link:
https://www.unpac.me/results/21059be1-d661-48ae-89a0-592906521ee1/
SH256 hash:
723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef
MD5 hash:
379d19e542b906f722b3eaf389cf494d
SHA1 hash:
50de550e205b82e095610e9f552e8bc46f3e16e6
Link:
https://www.unpac.me/results/21059be1-d661-48ae-89a0-592906521ee1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/364469/

Comments