MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1f61d04c3d02ac001fcd24ba344bd658c9a37931ab137fa836924f05de07731. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	b1f61d04c3d02ac001fcd24ba344bd658c9a37931ab137fa836924f05de07731
SHA3-384 hash:	b3f5e291bb4220683dea875ca645897102cb7e5a721736104ce47512c959205bd1bac4fc7bfd85920daa02838eccb740
SHA1 hash:	03406b086df6bcea781427c523d331aa4a7ba229
MD5 hash:	ad800c65e1a41adac0c6c235fd146015
humanhash:	oregon-hawaii-steak-sierra
File name:	b1f61d04c3d02ac001fcd24ba344bd658c9a37931ab137fa836924f05de07731
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	3'024'604 bytes
First seen:	2020-11-12 14:05:05 UTC
Last seen:	2024-07-24 20:29:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	676f4bc1db7fb9f072b157186a10179e (1'400 x AveMariaRAT, 37 x Riskware.Generic, 2 x njrat)
ssdeep	24576:TrK7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHR:TrK7AAmw4gxeOw46fUbNecCCFbNecc
Threatray	3'852 similar samples on MalwareBazaar
TLSH	1BE5AFB6763E004BEE3A50B2610F5910828E157BE702BB9F7B7BBA19D4832D551D334B
Reporter	seifreed
Tags:	AveMariaRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Running batch commands

Creating a process with a hidden window

Forced system process termination

Creating a window

Creating a file in the %temp% directory

Creating a file

Launching a process

Creating a file in the Windows subdirectories

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Creating a file in the mass storage device

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b1f61d04c3d02ac001fcd24ba344bd658c9a37931ab137fa836924f05de07731/

Threat name:

Win32.Spyware.AveMaria

Status:

Malicious

First seen:

2020-11-12 14:06:46 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wh3b2bgd2avmaap42jf2grf5mwgjun4tdkytp6udnespaxpao4yq._file

Verdict:

suspicious

AveMariaRAT

2cca72e6437bfe2378dfd090b0e5d1c702aa43567eb4449e1438340bd2a1ffec

AveMariaRAT

2ed471d2f72159ce898baed12a3f09670a5eda0da42a615432e274f56af3c838

AveMariaRAT

516f5903f415000d759c5dbd52f83703646cc531decf0b4a48466f828cc7fc04

AveMariaRAT

720d5efa9da834f02070731e4c63ba4f88bf047fd4e514369abc177183facfc1

AveMariaRAT

92cfdeaa1047206e26309824a3c42fa85779bc4679c940db2459e71352a45d39

AveMariaRAT

966b89d6d7cf241f4820acabfa3cbdd5c2322cc02e98fc9d3cd50249bcf3b5e8

AveMariaRAT

ce09b46a29f85f9f9264efff2dfc133582d61b4af9972f39c33f99732fdefa9e

AveMariaRAT

e420dd12e24cd9f9c1c1ffe71170b7218997b423d126d031fb948b183f803e79

AveMariaRAT

f532ce19488ff58564c10283cfebf1d88c52802a6bb1ad9dcf6aa8ad39936b3c

AveMariaRAT

+ 3'842 additional samples on MalwareBazaar

Unpacked files

SH256 hash:

b1f61d04c3d02ac001fcd24ba344bd658c9a37931ab137fa836924f05de07731

MD5 hash:

ad800c65e1a41adac0c6c235fd146015

SHA1 hash:

03406b086df6bcea781427c523d331aa4a7ba229

Detections:

win_ave_maria_g0

Link:

https://www.unpac.me/results/134e7914-b548-4d8b-94d2-0bd94434330d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b1f61d04c3d02ac001fcd24ba344bd658c9a37931ab137fa836924f05de07731

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ave_maria_warzone_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_EXE_Packed_ASPack Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ASPack

Rule name:	RDPWrap Create hunting rule
Author:	@bartblaze
Description:	Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:	https://github.com/stascorp/rdpwrap

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample