MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7a7a3daf875f119061c9bfbc15ed1d5fc271444858a74b1a603af7b19fadab15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AveMariaRAT
Vendor detections: 15
| SHA256 hash: | 7a7a3daf875f119061c9bfbc15ed1d5fc271444858a74b1a603af7b19fadab15 |
|---|---|
| SHA3-384 hash: | a1e8ad8e87090ee288d5b699a923939da617af09bc47d8e1002ca08db5f1b1b039ce7f10e9ec6c8f028e5000f7784fb9 |
| SHA1 hash: | edf1411f2ba7959323de8a7464f5b98fd25b6e5d |
| MD5 hash: | 40ace58fe70c61a6f552e38b2632a569 |
| humanhash: | snake-bakerloo-bakerloo-mockingbird |
| File name: | RFQ- 28300NB.scr |
| Download: | download sample |
| Signature | AveMariaRAT |
| File size: | 1'016'571 bytes |
| First seen: | 2021-10-04 12:59:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 24576:rAOcZEhvxirQvKQu3hawU4H9H721vDMHKX:thxirQvjuJU4H9HOz |
| Threatray | 2'385 similar samples on MalwareBazaar |
| TLSH | T10F251201F7D2C8B2D4732D325A39A7416D7DBD302F29DA5FA7E84DADDA301C05225BA2 |
| File icon (PE): |  |
| dhash icon | a4a1b4ecd335ff5b (25 x NanoCore, 4 x AgentTesla, 2 x RemcosRAT) |
| Reporter |  lowmal3 |
| Tags: | AveMariaRAT exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ- 28300NB.scr
Verdict:
Malicious activity
Analysis date:
2021-10-04 13:01:45 UTC
Tags:
trojan rat stealer avemaria
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RDPWrap
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file
Adding an access-denied ACE
Launching a process
Deleting a recently created file
Replacing files
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware overlay packed
Malware family:
AVE_MARIA
Verdict:
Malicious
Result
Threat name:
AveMaria UACMe
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to create processes via WMI
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates a thread in another existing process (thread injection)
Creates files in alternative data streams (ADS)
Creates processes via WMI
Drops PE files with a suspicious file extension
Drops script or batch files to the startup folder
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Powershell Defender Exclusion
Writes to foreign memory regions
Yara detected AveMaria stealer
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Detection:
avemaria
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2021-09-21 08:22:56 UTC
AV detection:
29 of 45 (64.44%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
avemaria
Similar samples:
+ 2'375 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Score:
10/10
Tags:
family:nanocore family:warzonerat infostealer keylogger persistence rat spyware stealer trojan
Behaviour
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Warzone RAT Payload
WarzoneRat, AveMaria
NanoCore
Malware Config
C2 Extraction:
membership.myddns.rocks:5191
Unpacked files
SH256 hash:
3a3c27101fa02a87e246c41c61d3095aeab550154b742db888610c916a2a77e9
MD5 hash:
572d1d074bdc7dd5a77783957de4e9af
SHA1 hash:
84c9a88fed51af4cd0503162bdd6e71db443cca4
Detections:
win_ave_maria_g0
win_ave_maria_auto
SH256 hash:
fc0c90044b94b080f307c16494369a0796ac1d4e74e7912ba79c15cca241801c
MD5 hash:
6b906764a35508a7fd266cdd512e46b1
SHA1 hash:
2a943b5868de4facf52d4f4c1b63f83eacd882a2
SH256 hash:
65f277fe461a5201d358541085c3f50c823a92baa440f74626c9d3183b916852
MD5 hash:
54093a5f8d372fc9ce22bb486c6861cf
SHA1 hash:
2fca43ea4c964aab28b9ade2d55cfb04e9373d9b
SH256 hash:
f067ff9cfe7e3c38773610f958c66c9a44a62878073ce1eda3af1a1cda616251
MD5 hash:
b4d38e4f2c6fee2a44a807c22efcb0c7
SHA1 hash:
1440a37b1788e746451ee983f95e685950507568
SH256 hash:
7a7a3daf875f119061c9bfbc15ed1d5fc271444858a74b1a603af7b19fadab15
MD5 hash:
40ace58fe70c61a6f552e38b2632a569
SHA1 hash:
edf1411f2ba7959323de8a7464f5b98fd25b6e5d
Malware family:
Warzone
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.