MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d36d90f9c2899d43c70a09d23e06ac6d151f738f83cd69d590c76d4bb9b6c9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d36d90f9c2899d43c70a09d23e06ac6d151f738f83cd69d590c76d4bb9b6c9e
SHA3-384 hash: 0b94ba19152f6c779300f6af05edf0458812ea75a97947b8560fe2fc5daf089829d62bcfdad50c065f6654c05d7708dc
SHA1 hash: a9bb146df2f8e1bd790e84f6d79d0cf5e6ed8532
MD5 hash: 998853d2395bc185980fe6a1c9bca541
humanhash: mars-california-saturn-charlie
File name:haretionrs.club_confirmation.exe.malw
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:617'984 bytes
First seen:2020-05-21 01:13:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd14599cca3bfe5eac2aca6e33e2157b (7 x AgentTesla, 3 x Loki, 1 x NanoCore)
ssdeep 12288:VBEm2TGS371Df9rjlPd+2ZrC0JA+FO/nrTDRISSN7qHp:VynTR7FVrD+OXSTV2q
Threatray 443 similar samples on MalwareBazaar
TLSH FBD4A032F6E15837C1631A7D9C1B57AC982BBE51392859CB7BE43C4C6F393853826293
Reporter ov3rflow1
Tags:AveMariaRAT malw

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Mal.Fareit-AA.12164.16199.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 13:39:54 UTC
File Type:
PE (Exe)
Extracted files:
275
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tu3nsd44fcm5ipdqucoshydky3ivd5zy7a6nnhkzbr3njo43nspa._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
4bc42280fb97c184cd9c1fc7c1424235924954d5a6d1124dd45ea009d240d260
AveMariaRAT
64874bde3de10c2904c8749f3a1ae47748932b21d64f7b562adf147dad03bb6d
AveMariaRAT
79624093602d22b967e0f25a549ccce2a0f032cbe89d784673f899544edc954e
AveMariaRAT
9f05fc0d62bbb451cfeb45c29b08ba8c556fcbc0aabcb1b783c056cca004db6e
AveMariaRAT
9f5f529e1cde2f349c22545f0385aecce812da1f3b7b0716a874a8beb8d25049
AveMariaRAT
ba6330b4e5e80f8184223a6ba094ae775fcee8f2d6409547b5aa1938d15405b8
AveMariaRAT
bdf768ac30153fead698380efb662efa3e4d3caaab38e85fb52e0ddafeac2a60
AveMariaRAT
d80f533d3202def1e03d6b4a21cc01eefb5cec003e4740174dbcfbc9112e17f4
AveMariaRAT
e85d8d1a443b9ae7ecc3dc3e40f6408cf69240e5853b9c7a2bb0f01e96dcdb9a
AveMariaRAT
ff3b81851b99eee686847214f6c932aecba77d021fdaa8c8a9ef28b2fdf34744
AveMariaRAT
+ 433 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer persistence rat
Link:
https://tria.ge/reports/201109-qzkqtcpzla/
Behaviour
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Warzone RAT Payload
ServiceHost packer
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_malumpos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/365649/

Comments