MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ecf1c276e10e3f3e9f7bc9e728fde9abea23348a2af6ce70269008d632a412d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 6 File information Comments 1

SHA256 hash:	8ecf1c276e10e3f3e9f7bc9e728fde9abea23348a2af6ce70269008d632a412d
SHA3-384 hash:	d0c7695135587ddd24e593ba11471ec32920e97dc182660f9c174895ce3539d5d6541a5a3d9d6610623cd8c4915ae389
SHA1 hash:	f317a837f52c4488e3de6eb665f13ae582474b47
MD5 hash:	feb6a0dc922843c710bd18edddb67980
humanhash:	berlin-maryland-triple-seventeen
File name:	update.bin
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	234'473 bytes
First seen:	2021-02-07 11:32:25 UTC
Last seen:	Never
File type:	rtf
MIME type:	text/rtf
ssdeep	6144:3XxWWFow8Fq1ge8MzPqUinQlIC4PFoZrv9dKjkmffMp+XsD5/:xWWFow4aPqUB5
TLSH	F434E654C1CA81C5F02B50846A55F8620437F4676BC88EF1333FC271FB9ED9B6A99A8D
Reporter	Arkbird_SOLG
Tags:	apt Confucius rtf

Intelligence

File Origin

# of uploads :

# of downloads :

276

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

update.rtf

Verdict:

Malicious activity

Analysis date:

2021-02-07 02:12:27 UTC

Tags:

ole-embedded

Link:

https://app.any.run/tasks/d10c0f31-e78e-47dd-916e-61c7b8850e20

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

File type:

application/rtf

Has a screenshot:

False

Contains macros:

False

Detection(s):

MiscreantPunch.EXEInsideOfRTF.2.UNOFFICIAL

Sanesecurity.Malware.27291.RtfHeur.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Launching a process

Creating a window

DNS request

Loading a suspicious library

Enabling autorun by creating a file

Result

Verdict:

Malicious

File Type:

RTF File

Link:

https://app.docguard.net/8ecf1c276e10e3f3e9f7bc9e728fde9abea23348a2af6ce70269008d632a412d/results/dashboard

Result

Verdict:

MALICIOUS

Details

Document With Few Pages

Document contains between one and three pages of content. Most malicious documents are sparse in page count.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/601272

Signature

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office process drops PE file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8ecf1c276e10e3f3e9f7bc9e728fde9abea23348a2af6ce70269008d632a412d/

Threat name:

Win32.Exploit.CVE-2017-0199

Status:

Malicious

First seen:

2021-02-05 17:46:28 UTC

AV detection:

16 of 29 (55.17%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/210207-6kv92mwv9n/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Launches Equation Editor

Modifies Internet Explorer settings

NTFS ADS

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Office loads VBA resources, possible macro or embedded object present

Drops file in Windows directory

Drops startup file

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Exploit

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/8ecf1c276e10e3f3e9f7bc9e728fde9abea23348a2af6ce70269008d632a412d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 Create hunting rule
Author:	ditekSHen
Description:	detects CVE-2017-8759 weaponized RTF documents.

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

https://twitter.com/mg2_tracy1/status/1358246040302850055

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

BlackAngel commented on 2021-02-07 11:33:05 UTC

Additional infos : https://twitter.com/ShadowChasing1/status/1358241114654871552