MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3
SHA3-384 hash: 941e48a5b15c4bc466c97cbcd9a4d59378c4adf2a9d66a80e5fc8ae75f01ec1bf339341d813eabe76f48fa18c1fe28b5
SHA1 hash: 38e26a5df8edc3fbc3924dd15b5f002aefb87060
MD5 hash: 175695e5766298896b7c780b2167ef55
humanhash: social-fourteen-south-sierra
File name:New Order.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:290'304 bytes
First seen:2020-08-10 09:54:51 UTC
Last seen:2020-08-10 11:07:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:ZtsgYS3/EX7p7vV9sUjb1NY58ZVTYV/B0HFW1vv2HKGLQk+c6fwrHD6YDl69w:sgYS3sX7p7vVyUjjY5CVTYv0HovuHZLr
Threatray 442 similar samples on MalwareBazaar
TLSH 77540260B3E7D20AC36B0B7E64D4959003F5A723E027EB0B2D84259B5A527DD0DE1F9B
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: www.fsc-netcom.biz
Sending IP: 211.16.211.187
From: anonymousfox-ei9vd@res-mar.ru
Subject: Purchase Detailed Inquiry
Attachment: New Order.rar (contains "New Order.exe")

AveMariaRAT C2:
chefdnshot.ddns.net:40951 (185.19.85.138)

% Information related to '185.19.84.0 - 185.19.85.255'

% Abuse contact for '185.19.84.0 - 185.19.85.255' is 'abuse@datawire.ch'

inetnum: 185.19.84.0 - 185.19.85.255
netname: DATAWIRE-DATACENTERS
descr: CUSTOMERS ZG01
country: CH
admin-c: DA4314-RIPE
tech-c: DA4314-RIPE
status: ASSIGNED PA
mnt-by: DATAWIRE-NOC
created: 2013-09-23T14:18:55Z
last-modified: 2013-09-23T14:18:55Z
source: RIPE

role: DATAWIRE AG
address: Hinterbergstrasse 22
admin-c: SH3634-RIPE
tech-c: SH3634-RIPE
nic-hdl: DA4314-RIPE
mnt-by: DATAWIRE-NOC
created: 2012-01-03T15:42:22Z
last-modified: 2013-08-25T14:21:45Z
source: RIPE # Filtered
abuse-mailbox: abuse@datawire.ch

% Information related to '185.19.84.0/22AS48971'

route: 185.19.84.0/22
descr: DATAWIRE AG DATACENTERS
origin: AS48971
mnt-by: DATAWIRE-NOC
created: 2013-03-07T20:43:03Z
last-modified: 2013-03-07T20:43:03Z
source: RIPE

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42649/
Detection(s):
SecuriteInfo.com.Generic.mg.175695e576629889.27015.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %AppData% directory
Unauthorized injection to a recently created process
DNS request
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Deleting a recently created file
Reading critical registry keys
Creating a file in the %temp% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/416713
Signature
Connects to many ports of the same IP (likely port scanning)
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to steal Mail credentials (via file access)
Uses dynamic DNS services
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 260762 Sample: New Order.exe Startdate: 10/08/2020 Architecture: WINDOWS Score: 100 34 Malicious sample detected (through community Yara rule) 2->34 36 Yara detected AveMaria stealer 2->36 38 Contains functionality to hide user accounts 2->38 40 6 other signatures 2->40 6 New Order.exe 1 4 2->6         started        9 test.exe 2 2->9         started        12 test.exe 2 2->12         started        process3 file4 28 C:\Users\user\AppData\Roaming\test.exe, PE32 6->28 dropped 30 C:\Users\user\...\test.exe:Zone.Identifier, ASCII 6->30 dropped 14 New Order.exe 3 2 6->14         started        18 New Order.exe 6->18         started        20 New Order.exe 6->20         started        42 Machine Learning detection for dropped file 9->42 22 test.exe 1 9->22         started        24 test.exe 1 12->24         started        26 test.exe 12->26         started        signatures5 process6 dnsIp7 32 chefdnshot.ddns.net 185.19.85.138, 40951, 49719 DATAWIRE-ASCH Switzerland 14->32 44 Tries to steal Mail credentials (via file access) 14->44 46 Increases the number of concurrent connection per server for Internet Explorer 14->46 48 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->48 signatures8
Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 09:56:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmje3ngp7rk7fu7oefxkohveekwt2tl76as5a2fezqrgd6sd4szq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
19fa55d64a5d0900b5f8604bb765ab9196e07b2716f1248e0a8c6245e12e2119
AveMariaRAT
220d9dee8512451f79c4ea016e9ed065ca3f378f3f1b29531cee3c686a100cce
AveMariaRAT
433d26c66e7c158b84024a6ee83ad8145598d238ed8855a21a77b8324715c9d8
AveMariaRAT
9d3c04431db8d2630361ac69def49189101a5bf017627be2f147bcd66f3c8d29
AveMariaRAT
be66827292b98575cb69b0898954699f52c491ddb0bc8c613a70d20fb3871657
AveMariaRAT
d045c6b114f25c29811bbb61864da2f464c9d5195b54d70008b7bbf91384b47f
AveMariaRAT
d0ca5d037015b6a8cc4fba70d698c781b9c0c445c408d4521e458d422a8e7e41
AveMariaRAT
da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a
AveMariaRAT
e6d6cda38ec798c76fb5727c7af199c496408484c68f3d7c0d34d6be09900ca0
AveMariaRAT
e97d4cbbbb923b04cee8f87235ad15ab83a7cba51984422cdfdcfefa7e81d457
AveMariaRAT
+ 432 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200810-zjlzjjyf1s/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
JavaScript code in executable
Adds Run key to start application
JavaScript code in executable
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Loads dropped DLL
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

rar 5ab4dfa57029017fbf39c7c78b9df1ad9b2514b2e916973cdf88be79b875b5b9

AveMariaRAT

Executable exe b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3

(this sample)

  
Dropped by
MD5 92f0933459d4442d34b978602ef6d0fb
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/42649/
  
Dropped by
SHA256 5ab4dfa57029017fbf39c7c78b9df1ad9b2514b2e916973cdf88be79b875b5b9

Comments