MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d
SHA3-384 hash: b939e18a61e96d0942d24cf2a05ed6969115ce9f0f5d3275f1906b2793fbdb62f43488fe07f9d0c4b05c1a17c3b178d3
SHA1 hash: e5208dfbe31500dc7463cef2b555e16bcbc1347d
MD5 hash: 8bb5443a351325862346e95674a7745d
humanhash: wyoming-eighteen-march-sixteen
File name:bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:841'728 bytes
First seen:2021-12-30 13:56:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fd738bdf3861116c40ccb9439519c3e8 (1 x AveMariaRAT)
ssdeep 12288:3zizgSdBxQlHO6S8bzbBSreaGz0hK1eu+yOLL5x7VLCJ1qUJoffLJG:3z8gSdBgHxZX1A8AuO5CJwUJoffo
Threatray 2 similar samples on MalwareBazaar
TLSH T13305C057E7D7FAB0E6FF827A86B2852C627B34530160A74E674071C96E22352493DB0F
Reporter Anonymous
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
307
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d
Verdict:
No threats detected
Analysis date:
2021-12-30 13:58:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/129917cd-dd95-4e22-af06-dd94662b5c69

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216866/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.21258.16048.7066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file
DNS request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3519/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed virut wacatac
Link:
https://www.filescan.io/uploads/61cdbab1ec6c6c14a9fe105b/reports/f0a49125-6d1f-46e8-af3e-4e9ce3d6a94e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c0e7071e-bb29-4853-9ba5-2d031058b1b6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/914064
Signature
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546542 Sample: c70OLnymvo Startdate: 30/12/2021 Architecture: WINDOWS Score: 52 19 Multi AV Scanner detection for submitted file 2->19 21 Sigma detected: Suspicious Call by Ordinal 2->21 7 loaddll64.exe 4 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 regsvr32.exe 3 7->11         started        13 rundll32.exe 1 7->13         started        15 2 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d/
Threat name:
ByteCode-MSIL.Trojan.Streamer
Create hunting rule
Status:
Malicious
First seen:
2021-12-30 03:26:27 UTC
File Type:
PE+ (Dll)
Extracted files:
2
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
02f05760666bda9018b95e442486c504cb67f02f5603406be55effc6dbf5c592
AveMariaRAT
c4379796b35d65d0589710688f14e01c1c59658299c8e85912ad6bbe17cd9a7b
AveMariaRAT
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat collection infostealer persistence rat spyware stealer
Link:
https://tria.ge/reports/211230-q89e2aeeal/
Behaviour
NTFS ADS
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Drops file in Program Files directory
Drops file in System32 directory
Accesses Microsoft Outlook profiles
Modifies WinLogon
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Sets DLL path for service in the registry
WarzoneRat, AveMaria
Unpacked files
SH256 hash:
bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d
MD5 hash:
8bb5443a351325862346e95674a7745d
SHA1 hash:
e5208dfbe31500dc7463cef2b555e16bcbc1347d
Link:
https://www.unpac.me/results/09ef0523-f466-475a-b073-e78eabadd5dc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/216866/

Comments