MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



AveMariaRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 12 File information Comments

SHA256 hash: 7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062
SHA3-384 hash: b80ea9f917c77c8f2f9abf9e5edbba8fc36bd926cec78a2970356f15df3fcc1d551dc05d53b7b7e339b5547d96cdb703
SHA1 hash: 27e5c643563bfe8dbccf7e26e9669c2cdde8e767
MD5 hash: 9e8d620f00f7988a79ae5c1228f37899
humanhash: foxtrot-colorado-lithium-lake
File name:JOB-in.line e.K. - New Order 56899707.exe
Download: download sample
Signature AveMariaRAT
File size:862'720 bytes
First seen:2022-08-05 08:46:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (31'208 x AgentTesla, 10'508 x Formbook, 5'466 x SnakeKeylogger)
ssdeep 12288:2k2oQCM0fSNakWL9Kh+gwv5ysdG5Ggdy/hkKJg6SKlpxw8r:xTSWLYh+geG5Gs2TnLlpxw8
Threatray 3'569 similar samples on MalwareBazaar
TLSH T1DA05CF41B6BA9A12C5740FB0DBA181500F34AD1B7D71F6CEE85835A63B71BB78B106CE
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 02f0f0e4e0e0e060 (1 x AveMariaRAT)
Reporter @FORMALITYDE
Tags:AveMariaRAT exe

Intelligence


File Origin
# of uploads :
1
# of downloads :
253
Origin country :
DE DE
Mail intelligence
No data
Vendor Threat Intelligence
Malware family:
avemaria
ID:
1
File name:
JOB-in.line e.K. - New Order 56899707.exe
Verdict:
Malicious activity
Analysis date:
2022-08-05 08:48:32 UTC
Tags:
trojan stealer rat avemaria warzone

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AveMaria, UACMe
Detection:
malicious
Classification:
phis.troj.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected AveMaria stealer
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Status:
Malicious
First seen:
2022-08-05 07:33:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
39
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Result
Malware family:
warzonerat
Score:
  10/10
Tags:
family:warzonerat infostealer rat
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Warzone RAT payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
20.91.187.223:5707
Unpacked files
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
SH256 hash:
cfac9b2cd62d849b47d0bfacf5dd704a1741ffc69e97f93b3008d991475277ea
MD5 hash:
e0ea60b1a92386927a2d62d1ef6204cd
SHA1 hash:
c2b9ae13da7d4a2c0782b64eb802ace180ac5821
Detections:
win_ave_maria_g0 win_ave_maria_auto
SH256 hash:
a3fcbe3bb1922f93373c62047ad596545095f7078f38d3aa9a59c9d42c315565
MD5 hash:
484e2dc1703c119dff5d73e8dadfdaec
SHA1 hash:
7d9ea1038c871af860f357090946f0757abfcd3b
SH256 hash:
95a7256e0a3ece49b0b273359309cb08ab1769228a43945f619faee100bdc15c
MD5 hash:
d66ac7e9668b75010a076e4ab1b627c2
SHA1 hash:
3c2414cc837f502b463c44c721c472abffaa0673
SH256 hash:
a9c5b2c628a47247402ff05d399855caf6f6a22146d44cd0fd9d7fc05a65ba66
MD5 hash:
228ff1006be83039e4de2b5e0475a5b0
SHA1 hash:
3adef5cc343067fa6b9d5e712114dc619c867a72
SH256 hash:
fc0c90044b94b080f307c16494369a0796ac1d4e74e7912ba79c15cca241801c
MD5 hash:
6b906764a35508a7fd266cdd512e46b1
SHA1 hash:
2a943b5868de4facf52d4f4c1b63f83eacd882a2
SH256 hash:
021d01fe3793879f57a2942664fc7c096710e94e87ad13dc21467c12edf61546
MD5 hash:
ad9fd1564dd1c6be54747e84444b8f55
SHA1 hash:
001495af4af443265200340a08b5e07dc2a32553
SH256 hash:
7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062
MD5 hash:
9e8d620f00f7988a79ae5c1228f37899
SHA1 hash:
27e5c643563bfe8dbccf7e26e9669c2cdde8e767

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:AveMaria
Author:@bartblaze
Description:Identifies AveMaria aka WarZone RAT.
Rule name:ave_maria_warzone_rat
Author:jeFF0Falltrades
Rule name:Codoso_Gh0st_1
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_1_RID2C2D
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Author:ditekSHen
Description:Detects executables embedding command execution via IExecuteCommand COM object
Rule name:MALWARE_Win_AveMaria
Author:ditekSHen
Description:AveMaria variant payload
Rule name:MALWARE_Win_WarzoneRAT
Author:ditekSHen
Description:Detects AveMaria/WarzoneRAT
Rule name:meth_peb_parsing
Author:Willi Ballenthin
Rule name:pe_imphash
Rule name:RDPWrap
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:Skystars_Malware_Imphash
Author:Skystars LightDefender
Description:imphash

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe 7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments