MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86fdfd47a9bb9fa65ec33a95cf4b3cfc246f182f68000809b3fdad7fef26c4c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86fdfd47a9bb9fa65ec33a95cf4b3cfc246f182f68000809b3fdad7fef26c4c8
SHA3-384 hash: 5179bf10a36ab3c18e351fd8df4adab046620f9f37522b835510ace324c74ecbd01559ed11a17d6c9e87bca8d5fedbcf
SHA1 hash: c4fcf2e11dda2627075f9aa16767a5bd385e53d7
MD5 hash: 3b7654dc26f2edbfa598cf6441c1d509
humanhash: vegan-lamp-beryllium-happy
File name:Tender SN980018277 & SN99018277 Soberano Sourcing GmbH.xz.lzh
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:659'109 bytes
First seen:2021-12-02 11:12:04 UTC
Last seen:Never
File type: lzh
MIME type:application/x-lzh-compressed
ssdeep 12288:OfPAt2hopKHwaJ/S3P3to8dcN+QWZEunOLtIY+dNdOLAWFDpF10XtiTY:OfPG6oQQauiAlSunOhIFdOLRFuXtMY
TLSH T108E412148D1CBDDDE2A647C24B8B3C1DB16E7232F1C49A8A379DC7460364E6F86A705B
Reporter c_APT_ure
Tags:avemaria lzh


Avatar
c_APT_ure
AveMaria stealer
MD5: 78e0265f9bc8991dbb309aa52612eb46
C2: pentester01[.]duckdns[.]org : 60977

Intelligence

File Origin
# of uploads :
1
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EQQS.15619.7234.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
50%
Link:
https://www.filescan.io/uploads/61a8aa0a86bf67e7121fa6b5/reports/43285196-3ef6-4da8-adb6-087e5779c8a0/overview
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86fdfd47a9bb9fa65ec33a95cf4b3cfc246f182f68000809b3fdad7fef26c4c8/
Threat name:
Win32.Infostealer.BestaFera
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 11:13:15 UTC
File Type:
Binary (Archive)
Extracted files:
135
AV detection:
5 of 45 (11.11%)
Threat level:
  5/5
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer persistence rat
Link:
https://tria.ge/reports/211202-naw1yaade7/
Behaviour
Modifies registry key
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Warzone RAT Payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
pentester01.duckdns.org:60977
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86fdfd47a9bb9fa65ec33a95cf4b3cfc246f182f68000809b3fdad7fef26c4c8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

lzh 86fdfd47a9bb9fa65ec33a95cf4b3cfc246f182f68000809b3fdad7fef26c4c8

(this sample)

AveMariaRAT

Executable exe 6072185720cbcf2add1e2ada668484a4d55c601fcb2840ca6b7fbf9dfacdefb8

  
Dropping
MD5 78e0265f9bc8991dbb309aa52612eb46
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6072185720cbcf2add1e2ada668484a4d55c601fcb2840ca6b7fbf9dfacdefb8

Comments