MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b98f29a897354964b324ad55f046ae324f4f43efe17abdfbbfd726792ec3c763. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b98f29a897354964b324ad55f046ae324f4f43efe17abdfbbfd726792ec3c763
SHA3-384 hash: 0bab9fb839769a1fdafc76926870ffecc44dc1849064bfa0a85862bb0a5c08be61d0ce4213bb54d5c18d5028fc765b61
SHA1 hash: 73d9442b234c5b4986f26a9383ef110db06c0837
MD5 hash: a7934b6dc187dbfc9dc76712139f533e
humanhash: east-finch-kilo-low
File name:RFQ-OM-3994 - Closing Date 30.11.2020 - MEPF-PO-2020-060PDF.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'525'560 bytes
First seen:2020-11-07 10:23:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b536cac2ec469377796e1e68bcbb6e43 (3 x ModiLoader, 3 x AveMariaRAT)
ssdeep 24576:Av1VZBy9ivRzx9cNGqi8h+Ncf5BY4KCoHdk:Avff7gh+NcPY4fcdk
Threatray 872 similar samples on MalwareBazaar
TLSH 2565CFB2A2814A32C55329384D1F7BA759367F282F6465132AF06D4CBE367C13539ECB
Reporter abuse_ch
Tags:AveMariaRAT exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: bulk134.smtp.cz
Sending IP: 185.12.196.134
From: Emily & Sales <8150110@naver.com>
Subject: Product Inquiry From Apex Global South Africa.
Attachment: RFQ-OM-3994 - Closing Date 30.11.2020 - MEPF-PO-2020-060PDF.z (contains "RFQ-OM-3994 - Closing Date 30.11.2020 - MEPF-PO-2020-060PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Pecompact-73
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
AveMaria ModiLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/523798
Signature
Allocates memory in foreign processes
Contains functionality to hide user accounts
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AveMaria stealer
Yara detected ModiLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 310995 Sample: RFQ-OM-3994 - Closing Date ... Startdate: 07/11/2020 Architecture: WINDOWS Score: 100 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected ModiLoader 2->43 45 3 other signatures 2->45 6 RFQ-OM-3994 - Closing Date 30.11.2020 - MEPF-PO-2020-060PDF.exe 1 16 2->6         started        11 Lxuzdrv.exe 14 2->11         started        13 Lxuzdrv.exe 13 2->13         started        process3 dnsIp4 25 cdn.discordapp.com 162.159.129.233, 443, 49726, 49740 CLOUDFLARENETUS United States 6->25 23 C:\Users\user\AppData\Local\...\Lxuzdrv.exe, PE32 6->23 dropped 47 Writes to foreign memory regions 6->47 49 Allocates memory in foreign processes 6->49 51 Creates a thread in another existing process (thread injection) 6->51 15 ieinstal.exe 3 4 6->15         started        53 Multi AV Scanner detection for dropped file 11->53 55 Machine Learning detection for dropped file 11->55 57 Injects a PE file into a foreign processes 11->57 19 ieinstal.exe 1 11->19         started        27 192.168.2.1 unknown unknown 13->27 21 ieinstal.exe 1 13->21         started        file5 signatures6 process7 dnsIp8 29 185.222.57.88, 49730, 5200 ROOTLAYERNETNL Netherlands 15->29 31 Tries to steal Mail credentials (via file access) 15->31 33 Tries to harvest and steal browser information (history, passwords, etc) 15->33 35 Increases the number of concurrent connection per server for Internet Explorer 15->35 37 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->37 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b98f29a897354964b324ad55f046ae324f4f43efe17abdfbbfd726792ec3c763/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 23:29:45 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xghstkexgvewjmzevvk7arvogjhu6q7p4f5l365724thslwdy5rq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0629278e51106220eb8727f80f4c24cfb432e6344561e8518030b19b669bcc72
AveMariaRAT
2cc5a802aaf99da12f98c79d28f14a2e850b9a9afc4c0f682430a425643d8cda
AveMariaRAT
4e420c5efeb26330ec4eb618426d859222b791798df3ae65c59fc20ef2f2889a
AveMariaRAT
52e8ebb47ae631081c6ac0ab78219951e8c7ac540e11b420e92d5df89ea719d7
AveMariaRAT
97b34cb713e879fb7cfe158a3180b73d1c71b71446368f242a0c004d0c3462dd
AveMariaRAT
9f5afe868a8dd23926e807303d8896b239b802a3c366e448f4c59a103540019f
AveMariaRAT
af84cf642737e0b62537d9a78861cc129fbc0e68a34770cb70c6ccaa3f553687
AveMariaRAT
b50f9caa6df41cf34a52f45f989dc38ba037fd68535f6d7015fe602c826b0c1c
AveMariaRAT
d30b949fc05b15b611b3fe420b6883062c5bb2b270c769540c48f703a46cbbf3
AveMariaRAT
f6878003c470e531787cd70fc0785bb01a5c64d6a39f0efec5aabc5ac3f5f889
AveMariaRAT
+ 862 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:warzonerat infostealer persistence rat trojan spyware
Link:
https://tria.ge/reports/201107-t54xbgax3x/
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
JavaScript code in executable
Loads dropped DLL
Reads user/profile data of web browsers
ModiLoader First Stage
ModiLoader Second Stage
Warzone RAT Payload
ModiLoader, DBatLoader
WarzoneRat, AveMaria
Unpacked files
SH256 hash:
e414ce45c87c498c4e4ab38a147f7731843d19b6410578ca9c630e1c62cf1dc2
MD5 hash:
1ec3547a26d73ede724424695be36d8c
SHA1 hash:
4ab71eaf4f5d116a2b634299b623833fa29ec7b2
Link:
https://www.unpac.me/results/9f7ae987-2869-437e-9fe2-71fdebe9a007/
SH256 hash:
b98f29a897354964b324ad55f046ae324f4f43efe17abdfbbfd726792ec3c763
MD5 hash:
a7934b6dc187dbfc9dc76712139f533e
SHA1 hash:
73d9442b234c5b4986f26a9383ef110db06c0837
Link:
https://www.unpac.me/results/9f7ae987-2869-437e-9fe2-71fdebe9a007/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Embedded_PE
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

z f87f1c9734b98fc57ccd73d8144484215d28b399aa3156d3d78b4cebf46ef0e8

AveMariaRAT

Executable exe b98f29a897354964b324ad55f046ae324f4f43efe17abdfbbfd726792ec3c763

(this sample)

  
Dropped by
MD5 5c17f8305887579e9385c3db3da12a2b
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 f87f1c9734b98fc57ccd73d8144484215d28b399aa3156d3d78b4cebf46ef0e8

Comments