MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 996ede8d9cb8561481707de2768ca29bf7294c66ac1de666cb390417eb2d9d60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 996ede8d9cb8561481707de2768ca29bf7294c66ac1de666cb390417eb2d9d60
SHA3-384 hash: c70e808b54de223e334cb1fa0c229338e09d7b4868e217b062ea16fca1af2ef5f700b892ebeef955a1d82505bc734e85
SHA1 hash: 53f8f6eb84dd15bea5a9c92dd40081b3450d3673
MD5 hash: 8c7358b6881453df8483055c123059e1
humanhash: seven-pasta-sierra-ten
File name:New supplier Inquiry and PO 208202850_ DOC.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:475'136 bytes
First seen:2020-08-27 05:40:26 UTC
Last seen:2020-08-27 07:19:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:HzHwOhiQ2XVYZETvNSP+HWdlXmSvspQy:TQOhP2FYZEJk+Hs5LWQy
Threatray 478 similar samples on MalwareBazaar
TLSH F7A4F054029D8F15ECEADA79E4293FC303A2AC81656DE33D8E5CB39618F6B404DD2763
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: smtp.aonbd.net
Sending IP: 117.58.240.41
From: Purchase Vertex Safety A.S <purchase.vertexsafety.com@protonmail.com>
Reply-To: Purchase Vertex Safety A.S <purchase.vertexsafety.com@protonmail.com>
Subject: Re: New Supplier Inquiry Vertex Instanbul Safety/Equipment/PO208202.
Attachment: New supplier Inquiry and PO 208202850_ DOC.uu (contains "New supplier Inquiry and PO 208202850_ DOC.exe")

AveMariaRAT C2:
divy.nerdpol.ovh:5200

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51591/
Detection(s):
SecuriteInfo.com.Fareit-FYV8C7358B68814.24670.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a process with a hidden window
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/452269
Signature
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to hide user accounts
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides user accounts
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 278496 Sample: New supplier Inquiry and PO... Startdate: 27/08/2020 Architecture: WINDOWS Score: 100 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 Sigma detected: Scheduled temp file as task from temp location 2->40 42 9 other signatures 2->42 7 New supplier Inquiry and PO 208202850_ DOC.exe 5 2->7         started        11 tsusbhub.sys 3 2->11         started        13 rdpdr.sys 8 2->13         started        15 rdpvideominiport.sys 4 2->15         started        process3 file4 28 C:\Users\user\AppData\Local\...\tmp72E2.tmp, XML 7->28 dropped 30 New supplier Inqui...202850_ DOC.exe.log, ASCII 7->30 dropped 32 C:\Users\user\AppData\...\yOVixifpXjva.exe, PE32 7->32 dropped 52 Injects a PE file into a foreign processes 7->52 17 New supplier Inquiry and PO 208202850_ DOC.exe 8 5 7->17         started        22 schtasks.exe 1 7->22         started        signatures5 process6 dnsIp7 34 divy.nerdpol.ovh 51.91.36.150, 49722, 5200 OVHFR France 17->34 26 C:\Program Files\Microsoft DN1\sqlmap.dll, PE32+ 17->26 dropped 44 Hides user accounts 17->44 46 Tries to steal Mail credentials (via file access) 17->46 48 Increases the number of concurrent connection per server for Internet Explorer 17->48 50 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->50 24 conhost.exe 22->24         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/996ede8d9cb8561481707de2768ca29bf7294c66ac1de666cb390417eb2d9d60/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:42:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tfxn5dm4xblbjalqpxrhndfctp3sstdgvqo6mzwlhecbp2zntvqa._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0ae65f7c31f2d20b9e4dbd96e2dde3162f2396bc2fd18be6cfd88f6118eb0778
AveMariaRAT
244d44fda9c8c6d0824059551aaf4a8f983affe67a77e9ce31459de208be4609
AveMariaRAT
25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e
AveMariaRAT
263bb9ed145f4847b527e4c0a1ad93fa24ad2fd0859a11825fe9d3cc97d5367b
AveMariaRAT
2d057909c6426fff14883d8ce85238843d07b25aeba5981219150ef72a33e49e
AveMariaRAT
4c0ba445450f16973c204aaab8265d888df2d38f822fbfcdf15249fbc3863356
AveMariaRAT
5623d57806cdca9774c3a13899e361f66948b648303e491bb79072faa715930c
AveMariaRAT
a4aa4637f92e6d1f0faea8c071cd561b154e3539a169976ebede90acf6760b99
AveMariaRAT
be2bc33b9acb5b939bc7cba84521cda274380a09b4acbe6e9696b8183352b5e8
AveMariaRAT
fe3f9f59dc784955366a2f7c9ff189b39710704b890b2e3aae3ffd0fbdac7539
AveMariaRAT
+ 468 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence spyware
Link:
https://tria.ge/reports/200827-61yhjfbvte/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in System32 directory
Modifies service
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
JavaScript code in executable
Maps connected drives based on registry
Modifies WinLogon
JavaScript code in executable
Maps connected drives based on registry
Modifies WinLogon
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Sets DLL path for service in the registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/996ede8d9cb8561481707de2768ca29bf7294c66ac1de666cb390417eb2d9d60

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 0eedca79e7b45750f378eac0de93c7e1470d3eaf69fff59fc6bf177bc975b02c

AveMariaRAT

Executable exe 996ede8d9cb8561481707de2768ca29bf7294c66ac1de666cb390417eb2d9d60

(this sample)

  
Dropped by
MD5 4b90f4dfeaf1cb1e3db2a456b174a60f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/51591/
  
Dropped by
SHA256 0eedca79e7b45750f378eac0de93c7e1470d3eaf69fff59fc6bf177bc975b02c

Comments