MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f
SHA3-384 hash:	94d31e31a920c7aeef27f6e819e7301892ce947a2a1e564f395b2829c7ce8e4c2272b81976faa548d92e0053b849f9a7
SHA1 hash:	781b88770f15ecdcb49dd1b59392572df23d2e38
MD5 hash:	a7481cb0fb4973b8875742d6f9087c50
humanhash:	fix-aspen-oregon-steak
File name:	request for quote (Iberia Express Aircraft) 16-02-2023·pdf.exe
Download:	download sample
Signature	AveMariaRAT Alert Create hunting rule
File size:	310'583 bytes
First seen:	2023-02-16 08:20:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	6144:i5lz/h0V18xnaWbSmvG9hykSm4o5v512f2tPLXovOV6C9SA/21TprgGC5:C4VsaWbSiGGho5b2+lryOwCj21T5k5
TLSH	T15B64028072B1F78BCCA1DE740A3ADB69569C3E243964164B7B62379FF636141CC5C382
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	61d0f0c8d4cce830 (2 x AveMariaRAT)
Reporter	lowmal3
Tags:	AveMariaRAT exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

212

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

request for quote (Iberia Express Aircraft) 16-02-2023·pdf.exe

Verdict:

Malicious activity

Analysis date:

2023-02-16 08:23:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/999637c0-6a96-4f66-9ebf-3b50b80446c9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/367088/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Multi.Generic.4c.11520.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Creating a file

Delayed reading of the file

Creating a file in the %temp% subdirectories

Sending a custom TCP request

DNS request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/70777/overview

Behaviour

MalwareBazaar

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/63ede7726bc4d77186fdc87b/reports/5ddf3797-838b-431f-8a18-b90f6c665819/overview

Hybrid Analysis Win/malicious_confidence_70%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e82a36e8-944a-401c-9cde-2ff6feea6877

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1176792

Signature

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-02-16 08:21:08 UTC

File Type:

PE (Exe)

Extracted files:

11

AV detection:

12 of 25 (48.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u75vym2h3lzbj6635r4k5mymvegas4tlnkt47ojjuvr23igutv7q._file

Threatray avemaria

Verdict:

malicious

Label(s):

avemaria

Alert

Create hunting rule

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/230216-j81pkagd2x/

Behaviour

Enumerates physical storage devices

Drops file in System32 directory

Checks installed software on the system

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

MD5 hash:

0d7ad4f45dc6f5aa87f606d0331c6901

SHA1 hash:

48df0911f0484cbe2a8cdd5362140b63c41ee457

Link:

https://www.unpac.me/results/64baade4-2916-4244-b120-a1bf97f655a2/

SH256 hash:

a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f

MD5 hash:

a7481cb0fb4973b8875742d6f9087c50

SHA1 hash:

781b88770f15ecdcb49dd1b59392572df23d2e38

Link:

https://www.unpac.me/results/64baade4-2916-4244-b120-a1bf97f655a2/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.23

Link:

https://yomi.yoroi.company/submissions/a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

exe a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/367088/