MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98f2b2581ee9388560dbedfbea2822f51ff98db2a7d180dc170326a755c8bffd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98f2b2581ee9388560dbedfbea2822f51ff98db2a7d180dc170326a755c8bffd
SHA3-384 hash: bc5926b6845d5b5d71702ebde4451580d424249c56aee1698a4c1430fa4385585de028429bfbd98a3c7a85266a4d6071
SHA1 hash: 9a06c9400cb2a0a82f18f89cf527f79e07cb0c7c
MD5 hash: 3c0549349b78a42e718b971158150ab3
humanhash: skylark-red-whiskey-florida
File name:IMG_3846.JPG.........................scr
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:2'438'752 bytes
First seen:2023-07-27 06:54:58 UTC
Last seen:2023-07-31 06:54:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5ae00e2dd0d6ab06bd890c0724ff7ed0 (2 x AveMariaRAT)
ssdeep 6144:ivGDOCLmsHGLPZpVYXtfSHuln0MbZGU3Tg+ujjcyM3LXTqenyfVn:mqOImPVVuln06lmjjclnyfVn
Threatray 2'347 similar samples on MalwareBazaar
TLSH T1F4B5CFB2B1DF8430D5B3193398D899631B7EF461065C5FAF2370CF260B750A099A4FAA
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 3a4a64700c483494 (1 x AveMariaRAT)
Reporter abuse_ch
Tags:AveMariaRAT exe scr

Intelligence

File Origin
# of uploads :
2
# of downloads :
288
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
avemaria
Create hunting rule
ID:
1
File name:
IMG_3846.JPG.........................scr
Verdict:
Malicious activity
Analysis date:
2023-07-27 07:06:04 UTC
Tags:
stealer rat avemaria warzone arkei
Link:
https://app.any.run/tasks/2b6fd9c2-3948-4952-98f6-09414a46b848

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/434675/
Detection(s):
SecuriteInfo.com.Variant.Jaik.157223.11152.7591.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Sending a custom TCP request
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% directory
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware masquerade overlay packed
Link:
https://www.filescan.io/uploads/64c214cace55ad2aeb823120/reports/a8e1c840-5e9e-467a-846d-950b78868805/overview
Verdict:
Malicious
Labled as:
Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/98f2b2581ee9388560dbedfbea2822f51ff98db2a7d180dc170326a755c8bffd
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AVE_MARIA
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/54c166ae-9d7f-4cee-96a7-16323b8c7a34
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1280895
Signature
Allocates memory in foreign processes
Contains functionality to hide user accounts
Drops PE files to the startup folder
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1280895 Sample: IMG_3846.JPG.................. Startdate: 27/07/2023 Architecture: WINDOWS Score: 100 34 Snort IDS alert for network traffic 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 6 other signatures 2->40 6 IMG_3846.JPG.........................scr.exe 3 2->6         started        10 Update.exe 3 2->10         started        process3 file4 26 C:\Users\user\AppData\Roaming\...\Update.exe, PE32 6->26 dropped 28 C:\Users\user\...\Update.exe:Zone.Identifier, ASCII 6->28 dropped 42 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 6->42 44 Drops PE files to the startup folder 6->44 46 Writes to foreign memory regions 6->46 12 AppLaunch.exe 3 6 6->12         started        16 WerFault.exe 20 9 6->16         started        18 conhost.exe 6->18         started        48 Allocates memory in foreign processes 10->48 50 Injects a PE file into a foreign processes 10->50 20 WerFault.exe 10 10->20         started        22 AppLaunch.exe 1 10->22         started        24 conhost.exe 10->24         started        signatures5 process6 dnsIp7 30 4410.fhpaul.com 3.135.209.48, 4410, 49681 AMAZON-02US United States 12->30 32 192.168.2.1 unknown unknown 12->32 52 Tries to steal Mail credentials (via file / registry access) 12->52 54 Tries to harvest and steal browser information (history, passwords, etc) 12->54 56 Increases the number of concurrent connection per server for Internet Explorer 12->56 58 2 other signatures 12->58 signatures8
Detection:
warzone
Create hunting rule
Link:
https://mwdb.cert.pl/sample/98f2b2581ee9388560dbedfbea2822f51ff98db2a7d180dc170326a755c8bffd/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-07-27 03:46:44 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdzlewa65e4ikyg35x56ukbc6up7tdnsu7iybxaxamtkovoix76q._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
28899cd77a674fd8fc103e44aa12ce58b76dadcdcdecca0637c774df8dbdc61c
AveMariaRAT
447de9f98d9a2e15fd94809353e7489e4448a3f48aa3c8937d8dbac8ad4c11b2
AveMariaRAT
555781a1e79cedec7352e9d85eb0a9f64dbbdee6873e481c91e35c48505e6ba2
AveMariaRAT
697414704680ccefd9708f44942e42efbfcba4009ae2029f0a6ad964051b36ba
AveMariaRAT
77db79af2f66fb41ede6dbb5c11e2864569f9781f5e78b06427e904a60505277
AveMariaRAT
8aefec7573b95dd50f25085dfad2459b660d811303a6d6614b0044ddb97a8dee
AveMariaRAT
bc328eb0e9ed41cce25d10b35e678f90b5f0363b59a48ee467b52d2dcdebb169
AveMariaRAT
f0b92472c6a95a379f7235c22460fdb3602d625a662141e7baecc48c049ad715
AveMariaRAT
fb9d0187ef58360b6877dc38f0509030b2e7d57d060deae2bb6e3233dda8f47d
AveMariaRAT
+ 2'337 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat collection infostealer rat
Link:
https://tria.ge/reports/230727-hpsn6sad46/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops startup file
Loads dropped DLL
Warzone RAT payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
4410.fhpaul.com:4410
Unpacked files
SH256 hash:
477cab8d4385172d679200edc6619462de2402d912f21f36981fc058987a6d52
MD5 hash:
16a9ddc4b32981114fe4f069a4353105
SHA1 hash:
bf73849f57c150f9e2199c61427f631be2dfa595
Link:
https://www.unpac.me/results/78c75353-81fe-42f0-af57-df60fd27b487/
SH256 hash:
f71d97c3d42af0eb4cc74e640a995eb0f288bab59b7be5cd89eccb21cd304f36
MD5 hash:
6c72218c48cd68cbcb654675053a0abb
SHA1 hash:
12207fa32070f99683648d87b44410e5d3cdf2de
Link:
https://www.unpac.me/results/78c75353-81fe-42f0-af57-df60fd27b487/
SH256 hash:
19c15be8c3ca626877a4dbf4402f9e4a17b3f37ba99f1b3f16274f12e5d85374
MD5 hash:
0b90c54d0c7ffffaef04102b7e1cba69
SHA1 hash:
3f13aaf8da6552d432b846a25f969684db1f7aea
Detections:
Warzone
Create hunting rule
win_ave_maria_g0
Create hunting rule
Link:
https://www.unpac.me/results/78c75353-81fe-42f0-af57-df60fd27b487/
SH256 hash:
98f2b2581ee9388560dbedfbea2822f51ff98db2a7d180dc170326a755c8bffd
MD5 hash:
3c0549349b78a42e718b971158150ab3
SHA1 hash:
9a06c9400cb2a0a82f18f89cf527f79e07cb0c7c
Link:
https://www.unpac.me/results/78c75353-81fe-42f0-af57-df60fd27b487/
Malware family:
Warzone
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/98f2b2581ee9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe 98f2b2581ee9388560dbedfbea2822f51ff98db2a7d180dc170326a755c8bffd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/434675/

Comments