MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3c7788876d75c3ca2c41fca2b40cac659970928ac868706046abd88931ce846. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3c7788876d75c3ca2c41fca2b40cac659970928ac868706046abd88931ce846
SHA3-384 hash: 4031ada47363b3eb2c643faf0f952514960eeb967c8713aa8587b6bbfc5d15fb696fc13edfd28ac175fd22f85fb54d57
SHA1 hash: 7b3e8b607c8150c065f00b9ad82afaed8d43b2c1
MD5 hash: 0beedf07a787aab7e4421d12bb26c2d5
humanhash: golf-steak-fillet-lion
File name:a3c7788876d75c3ca2c41fca2b40cac659970928ac868706046abd88931ce846
Download: download sample
File size:6'422'931 bytes
First seen:2020-06-16 09:24:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 676f4bc1db7fb9f072b157186a10179e (1'400 x AveMariaRAT, 37 x Riskware.Generic, 2 x njrat)
ssdeep 49152:ATU7AAmw4gxeOw46fUbNecCCFbNecFTU7AAmw4gxeOw46fUbNecCCFbNecU:ATU7d9xZw46G8q8mTU7d9xZw46G8q8H
Threatray 1'364 similar samples on MalwareBazaar
TLSH F956AEE9791E500BF323B4B1940F86208755BD2DF247B7BF6B243F1A84A33DAD186646
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10666/
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Ursu-6793772-0
Create hunting rule

Win.Malware.Ursu-6914170-0
Create hunting rule

Win.Malware.Ursu-6914171-0
Create hunting rule

Win.Malware.Cerber-6989221-0
Create hunting rule

Gathering data
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 16:14:03 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
44 of 48 (91.67%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
20232a6aa0611a2a174fedae02b41b42e6125de3dcb443e5123ac7af0f3c33fb
2cbfb5b5238c10c431fa755298761b8800c34ee953d3e1363e6c61c53830ebcc
38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837
55461b9a911c4a9fb7de66db5a891b859755f5cab7cde452c2e43f68822fda5a
5ef93b76b923b5e541eab0060d613166f92d4571dc5fede5109fc501bd78b050
62d78395696e2c85de61f3bae5cd895eb3919e41ba7e18b6381886280f26efbf
6e0c57860fd63458bbcd929909d9001354d8ff470c66734cba7eaec86c00d446
a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e
a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435
bd52404743f2914218a89eb081442ab810148fc27b95f799036d5d6767a3f5db
+ 1'354 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/200624-ccx7s5wm2x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Modifies the visibility of hidden or system files
Executes dropped EXE
Modifies Installed Components in the registry
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10666/

Comments