MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4
SHA3-384 hash: acb51a7a219b010ab7cded9982a425e6a2aa4973cfcb4d6837ae3ea91c73b92ad46da48cb2c9179e762ec97990431377
SHA1 hash: 1919478674e42a28de4d7604bab84de201a38556
MD5 hash: 1e8d607206d7c754e9303151f126c224
humanhash: wolfram-enemy-south-ceiling
File name:Apol_020821_doc.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:734'208 bytes
First seen:2021-08-02 11:57:02 UTC
Last seen:2021-08-02 13:16:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:X1qKoL2Nz5nlb8uYhkOH7NeuWnSI3qbc6uK4Eg9qfu2LV:X1sLU1lb853fI3NpJEgob
Threatray 1'335 similar samples on MalwareBazaar
TLSH T1E0F4BF1B3B806BD5E2084F7AD917974883F4994B7272F3FF18D42AF04931706BA1E5A6
dhash icon 18f9f0dccaf07071 (2 x Formbook, 1 x AveMariaRAT, 1 x Loki)
Reporter lowmal3
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Apol_020821_doc.exe
Verdict:
Malicious activity
Analysis date:
2021-08-02 11:59:16 UTC
Tags:
trojan stealer rat avemaria
Link:
https://app.any.run/tasks/e2574d1d-aec2-4b92-8376-37c19ba5e650

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/175791/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Creating a window
Running batch commands
Launching a process
Sending a UDP request
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Enabling autorun
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/54dca4ec-368e-4f66-86fd-0c28c5127b5b
Result
Threat name:
AveMaria UACMe
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/825480
Signature
.NET source code contains very large array initializations
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to prevent local Windows debugging
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates an undocumented autostart registry key
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Writes to foreign memory regions
Yara detected AveMaria stealer
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 457892 Sample: Apol_020821_doc.exe Startdate: 02/08/2021 Architecture: WINDOWS Score: 100 58 Malicious sample detected (through community Yara rule) 2->58 60 Yara detected UACMe UAC Bypass tool 2->60 62 Yara detected AveMaria stealer 2->62 64 4 other signatures 2->64 8 Apol_020821_doc.exe 15 7 2->8         started        process3 dnsIp4 54 www.google.com 142.250.180.164, 443, 49706, 49718 GOOGLEUS United States 8->54 42 C:\Users\user\AppData\Roaming\tglbin.exe, PE32 8->42 dropped 44 C:\Users\user\AppData\Local\...\AppLaunch.exe, PE32 8->44 dropped 46 C:\Users\user\...\tglbin.exe:Zone.Identifier, ASCII 8->46 dropped 48 C:\Users\user\...\Apol_020821_doc.exe.log, ASCII 8->48 dropped 78 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->78 13 tglbin.exe 14 5 8->13         started        18 cmd.exe 1 8->18         started        file5 signatures6 process7 dnsIp8 56 www.google.com 13->56 50 C:\Users\user\AppData\Local\Temp\bvt55.exe, PE32 13->50 dropped 80 Multi AV Scanner detection for dropped file 13->80 82 Machine Learning detection for dropped file 13->82 84 Writes to foreign memory regions 13->84 86 2 other signatures 13->86 20 AppLaunch.exe 3 2 13->20         started        24 bvt55.exe 2 13->24         started        26 bvt55.exe 13->26         started        32 2 other processes 13->32 28 reg.exe 1 1 18->28         started        30 conhost.exe 18->30         started        file9 signatures10 process11 dnsIp12 52 renajazi.linkpc.net 185.157.161.56, 49729, 9494 OBE-EUROPEObenetworkEuropeSE Sweden 20->52 66 Contains functionality to inject threads in other processes 20->66 68 Contains functionality to steal Chrome passwords or cookies 20->68 70 Contains functionality to steal e-mail passwords 20->70 76 3 other signatures 20->76 72 Multi AV Scanner detection for dropped file 24->72 34 bvt55.exe 24->34         started        36 bvt55.exe 26->36         started        74 Creates an undocumented autostart registry key 28->74 38 bvt55.exe 32->38         started        40 bvt55.exe 32->40         started        signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-02 11:34:52 UTC
AV detection:
14 of 27 (51.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pi7mai27tqtlxd6rkasxj3lh5kvuph5idzoybv5w6w24yiyoy72a._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
18ccd421e41af7dedbdeff8e6d3df085182c3fb7e2f27d9e4594553dcbc2834b
AveMariaRAT
46520e8955eff183518aa7ad908eff5e9d0c7094be0d9821f037a11a25ff4b3e
AveMariaRAT
7406e77d7cbbc5344697900906c5a5930330dcdfba382b22181b41494ace670e
AveMariaRAT
88cd6b3cae21bbdf028d5fee94c3552ecc427043b70b8407e9f936857c637ee5
AveMariaRAT
aae06c61ea30fd920db8caa7e32eefe1b74842affe3fa6d53ce6765f49783ed5
AveMariaRAT
b59b27b89189fc7fd98bc8f8a70d7d500907439cba4303c1eb812532fa2bc96f
AveMariaRAT
da31c02c004f7e04408dea6429c362b4870c87a99fb2ae8ace1dac200a7fce5d
AveMariaRAT
e05ae83047c3026873ff147e2b6e6a71ab396d23ee8c9346b2755c16a776774b
AveMariaRAT
f0a689eaa58530a612a628a8c0b87c6709aa6d98260743f61a65b32b26a11bf2
AveMariaRAT
f4be91d5771599ee3f80dd26990d324c291e4b327db563c15379b09ffa79eadb
AveMariaRAT
+ 1'325 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat agilenet infostealer persistence rat
Link:
https://tria.ge/reports/210802-fvse3y72pa/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
Warzone RAT Payload
Modifies WinLogon for persistence
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
renajazi.linkpc.net:9494
Unpacked files
SH256 hash:
7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4
MD5 hash:
1e8d607206d7c754e9303151f126c224
SHA1 hash:
1919478674e42a28de4d7604bab84de201a38556
Link:
https://www.unpac.me/results/f37b58c7-0177-4cf5-8c8d-1356c3a805e0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe 7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/175791/

Comments