MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ce5eb576c72ecc29eabbbece917f1873bf4f5782485b22549dfbb6ff1d56f58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ce5eb576c72ecc29eabbbece917f1873bf4f5782485b22549dfbb6ff1d56f58
SHA3-384 hash: 6d6de957ccfa5900a9e22655e10c7044d41a553d00a2e6489c7fd0584fd28d5e824b8e85aafeddf7cad779082bd790d0
SHA1 hash: 6f5f724278b45af030c542bb79c36bb11d5a405d
MD5 hash: 2c254191a27a7eed92172f750c278e29
humanhash: william-vegan-lactose-fruit
File name:Uaqvbdc.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:989'698 bytes
First seen:2020-05-01 08:12:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c8a22c0423451ea1e4122bc2e70af18 (8 x GuLoader, 1 x RemcosRAT, 1 x AveMariaRAT)
ssdeep 12288:Mi2KmIpZ7l+/yO3VhZjgMU4eB7hqcXdpe7ecxBOPY4Jvjg3FVLg904yp4lFjj:MFGl0ycAF1dpieqBOPYovEZ4y+Fj
Threatray 441 similar samples on MalwareBazaar
TLSH 4925AF63B2C04877D0731E78DD1B93689827BD612A2468C677F53D4C9F393A13A3A297
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: thenesscenter.org
Sending IP: 45.249.91.173
From: Ashley <abrown@thenesscenter.org>
Subject: Fw: Re: IMPORTANT MESSAGE
Attachment: INVOICE887.rar (contains "Uaqvbdc.exe")

AveMariaRAT payload URL:
http://acdesignhub.com/AAddropboxusercontent52t2jofjdp8lir2361P9A8E8B0G4YF1LIhiMK155

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7735852-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 00:17:51 UTC
File Type:
PE (Exe)
Extracted files:
57
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tts6wv3molwmfhvlxpwosf7rq457j5lyesc3ejkj365w74ovn5ma._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
4343e77b4710f4ea72e445b733076ba3495be7f1c94b88d73ff70b6f03711c3e
AveMariaRAT
4b13bb36220d46ab9fa89c4163c8ec571fe0c113af00773d0968fa51c4056bbd
AveMariaRAT
6eb590a11b5310606564853be8c43179b95ee93c3a4c8c3ea8f011819a3b2337
AveMariaRAT
7c7fbeb0b90a27a56ddbd1adee5627396a0d3f4639bea0d8675687a66064b6c8
AveMariaRAT
7f29131cb5f28ccbd60dbdf39b6b3c79a974d4a3950aac1d1c0f7edd68193c03
AveMariaRAT
7f62e5e2d0cfbe0740718588465b71a701fe3e188a8a4755baacbdc6fb41d52c
AveMariaRAT
9c62d911a4efd2a37364d26439085d493ca2ab7e4b0fa90ba2f5d937e99e5bdf
AveMariaRAT
b38f7cacc56a97f122827cc2e89c55c9747ad790f7649b6078cedca83659b4dc
AveMariaRAT
cb5c24e649bfdd00c9d03e8c16dfda3f1101fb531b94fd57922339a12e22a0d6
AveMariaRAT
e43d34170181b3e9b5baf550d70b27fdbcfcc8e974694352d77e5e52e8866a2d
AveMariaRAT
+ 431 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 6bcc52dfedf9716eabf70d30f4cc4932d8c021bd1befb4a08112bc286c17a26d

AveMariaRAT

Executable exe 9ce5eb576c72ecc29eabbbece917f1873bf4f5782485b22549dfbb6ff1d56f58

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/355395/
  
Dropped by
MD5 08a845acd6a58df77c15bcb4344158f6
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 6bcc52dfedf9716eabf70d30f4cc4932d8c021bd1befb4a08112bc286c17a26d

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowA
user32.dll::OpenClipboard
user32.dll::PeekMessageA

Comments