MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c7fbeb0b90a27a56ddbd1adee5627396a0d3f4639bea0d8675687a66064b6c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c7fbeb0b90a27a56ddbd1adee5627396a0d3f4639bea0d8675687a66064b6c8
SHA3-384 hash: 8730aa3f253348acff6328a8be42fd4bdf705b41c15bac4d13f819d801a1309507f40835b79c90bb133c8490a5bb7617
SHA1 hash: 52a2648c0f30be358a0822c91d1ee45f424cf250
MD5 hash: 7dca0b8fc69ff378f769f67a08323ecf
humanhash: eighteen-juliet-triple-jig
File name:Kiilduvre_newwar.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:103'936 bytes
First seen:2020-05-06 19:06:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 879635b629affd65258851469f9bf6f9 (31 x AveMariaRAT)
ssdeep 1536:lvqIPE8ddFD1frrq7gVxoNGPNJKF1m+xVE0/bK:cI8CxFVxAMNJKu+xVE0TK
Threatray 423 similar samples on MalwareBazaar
TLSH E1A39D2377D14439F67102B02CB97F79CABFBE380221855BD72456876F31994EA263A3
Reporter James_inthe_box
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Maria.4.17072.22484.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Maria.3.30306.22950.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Antiav
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 19:06:50 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
44 of 48 (91.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pr735mfzbit2k3o32gw64vrhhfva2p2ghg7kbwdhk2d2mydew3ea._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
396ce7128d66f4693a84c9a7433d5154d3f356e03e61e71a0492177d108c3a95
AveMariaRAT
5dd2674c9f116740c0132fca0553257cd52d8785a7ff47dd6d361b30a9634189
AveMariaRAT
6eb590a11b5310606564853be8c43179b95ee93c3a4c8c3ea8f011819a3b2337
AveMariaRAT
7b7b7e7ad9b106a5508583f1b60e3a3d7385bf0d6592ca816839f6633f5e8045
AveMariaRAT
94c5bf5ba01bdb8b028fe00eca0d805b8150c3639ce9e3cf0b86670061d66196
AveMariaRAT
9c62d911a4efd2a37364d26439085d493ca2ab7e4b0fa90ba2f5d937e99e5bdf
AveMariaRAT
9ce5eb576c72ecc29eabbbece917f1873bf4f5782485b22549dfbb6ff1d56f58
AveMariaRAT
b38f7cacc56a97f122827cc2e89c55c9747ad790f7649b6078cedca83659b4dc
AveMariaRAT
c9d35153c2220d608ca08a3e4b26bd01a105e9e99c2bbc6c464f629f6ab472cb
AveMariaRAT
e43d34170181b3e9b5baf550d70b27fdbcfcc8e974694352d77e5e52e8866a2d
AveMariaRAT
+ 413 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer rat
Link:
https://tria.ge/reports/201109-qx9ndm115e/
Behaviour
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments