MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AveMariaRAT
Vendor detections: 16
| SHA256 hash: | 7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062 |
|---|---|
| SHA3-384 hash: | b80ea9f917c77c8f2f9abf9e5edbba8fc36bd926cec78a2970356f15df3fcc1d551dc05d53b7b7e339b5547d96cdb703 |
| SHA1 hash: | 27e5c643563bfe8dbccf7e26e9669c2cdde8e767 |
| MD5 hash: | 9e8d620f00f7988a79ae5c1228f37899 |
| humanhash: | foxtrot-colorado-lithium-lake |
| File name: | JOB-in.line e.K. - New Order 56899707.exe |
| Download: | download sample |
| Signature | AveMariaRAT |
| File size: | 862'720 bytes |
| First seen: | 2022-08-05 08:46:26 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (31'208 x AgentTesla, 10'508 x Formbook, 5'466 x SnakeKeylogger) |
| ssdeep | 12288:2k2oQCM0fSNakWL9Kh+gwv5ysdG5Ggdy/hkKJg6SKlpxw8r:xTSWLYh+geG5Gs2TnLlpxw8 |
| Threatray | 3'569 similar samples on MalwareBazaar |
| TLSH | T1DA05CF41B6BA9A12C5740FB0DBA181500F34AD1B7D71F6CEE85835A63B71BB78B106CE |
| TrID | 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | 02f0f0e4e0e0e060 (1 x AveMariaRAT) |
| Reporter | @FORMALITYDE |
| Tags: | AveMariaRAT exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
253
Origin country :
DEMail intelligence
No data
Vendor Threat Intelligence
Malware family:
avemaria
ID:
1
File name:
JOB-in.line e.K. - New Order 56899707.exe
Verdict:
Malicious activity
Analysis date:
2022-08-05 08:48:32 UTC
Tags:
trojan stealer rat avemaria warzone
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
WarzoneRAT
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
AveMaria, UACMe
Detection:
malicious
Classification:
phis.troj.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected AveMaria stealer
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Status:
Malicious
First seen:
2022-08-05 07:33:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
39
AV detection:
22 of 26 (84.62%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
avemaria
Similar samples:
+ 3'559 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Score:
10/10
Tags:
family:warzonerat infostealer rat
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Warzone RAT payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
20.91.187.223:5707
Unpacked files
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
SH256 hash:
cfac9b2cd62d849b47d0bfacf5dd704a1741ffc69e97f93b3008d991475277ea
MD5 hash:
e0ea60b1a92386927a2d62d1ef6204cd
SHA1 hash:
c2b9ae13da7d4a2c0782b64eb802ace180ac5821
Detections:
win_ave_maria_g0
win_ave_maria_auto
SH256 hash:
a3fcbe3bb1922f93373c62047ad596545095f7078f38d3aa9a59c9d42c315565
MD5 hash:
484e2dc1703c119dff5d73e8dadfdaec
SHA1 hash:
7d9ea1038c871af860f357090946f0757abfcd3b
SH256 hash:
95a7256e0a3ece49b0b273359309cb08ab1769228a43945f619faee100bdc15c
MD5 hash:
d66ac7e9668b75010a076e4ab1b627c2
SHA1 hash:
3c2414cc837f502b463c44c721c472abffaa0673
SH256 hash:
a9c5b2c628a47247402ff05d399855caf6f6a22146d44cd0fd9d7fc05a65ba66
MD5 hash:
228ff1006be83039e4de2b5e0475a5b0
SHA1 hash:
3adef5cc343067fa6b9d5e712114dc619c867a72
SH256 hash:
fc0c90044b94b080f307c16494369a0796ac1d4e74e7912ba79c15cca241801c
MD5 hash:
6b906764a35508a7fd266cdd512e46b1
SHA1 hash:
2a943b5868de4facf52d4f4c1b63f83eacd882a2
SH256 hash:
021d01fe3793879f57a2942664fc7c096710e94e87ad13dc21467c12edf61546
MD5 hash:
ad9fd1564dd1c6be54747e84444b8f55
SHA1 hash:
001495af4af443265200340a08b5e07dc2a32553
SH256 hash:
7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062
MD5 hash:
9e8d620f00f7988a79ae5c1228f37899
SHA1 hash:
27e5c643563bfe8dbccf7e26e9669c2cdde8e767
Malware family:
Warzone
Verdict:
Malicious
AV coverage:
35.71%
AV detections:
25 / 70
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.
| Rule name: | AveMaria |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies AveMaria aka WarZone RAT. |
| Rule name: | ave_maria_warzone_rat |
|---|---|
| Author: | jeFF0Falltrades |
| Rule name: | Codoso_Gh0st_1 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects Codoso APT Gh0st Malware |
| Reference: | https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks |
| Rule name: | Codoso_Gh0st_1_RID2C2D |
|---|---|
| Author: | Florian Roth |
| Description: | Detects Codoso APT Gh0st Malware |
| Reference: | https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables embedding command execution via IExecuteCommand COM object |
| Rule name: | MALWARE_Win_AveMaria |
|---|---|
| Author: | ditekSHen |
| Description: | AveMaria variant payload |
| Rule name: | MALWARE_Win_WarzoneRAT |
|---|---|
| Author: | ditekSHen |
| Description: | Detects AveMaria/WarzoneRAT |
| Rule name: | meth_peb_parsing |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | pe_imphash |
|---|
| Rule name: | RDPWrap |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies RDP Wrapper, sometimes used by attackers to maintain persistence. |
| Reference: | https://github.com/stascorp/rdpwrap |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your Twitter account.