MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be66827292b98575cb69b0898954699f52c491ddb0bc8c613a70d20fb3871657. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 7 File information Comments

SHA256 hash:	be66827292b98575cb69b0898954699f52c491ddb0bc8c613a70d20fb3871657
SHA3-384 hash:	886f3492f1e2ced3e2d988bbfe2571952b2481ae83ddc1cc70fb5ca03d57ba6fc0cada21cc19019cfd0464cb3b6c7fe5
SHA1 hash:	079f2ade170d5b4bdb709fa1ccd193b11939261a
MD5 hash:	414b9d6f9dd1348b4c4c768b3c1039ac
humanhash:	whiskey-pizza-eight-twelve
File name:	PURCHASE ORDER AFC of IOCL TKIS.exe
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	294'912 bytes
First seen:	2020-06-29 09:01:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	6144:SijhnOnm103MYAQ64tm7wgacw3Jb3BPDZvoFuZtNdJLf7VFIi:Qnm10FFBgMPPDRZZBJNFIi
Threatray	546 similar samples on MalwareBazaar
TLSH	1A54BE2173F98716C6BF47F944A0015417BA35526A23D7AD8EC670DB2EB27C10B0BB6B
Reporter	abuse_ch
Tags:	AveMariaRAT exe nVpn RAT

abuse_ch

Malspam distributing AveMariaRAT:

HELO: sip2-191.nexcess.net
Sending IP: 104.207.255.152
From: Mehta, Abhijit <Abhijit.Mehta@kelvion.com>
Subject: Enquiry for Local Control Station - IOCL TKIS Project
Attachment: PURCHASE ORDER AFC of IOCL TKIS.cab (contains "PURCHASE ORDER AFC of IOCL TKIS.exe")

AveMariaRAT C2:
caebd.ddns.net:8822 (194.5.98.129)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.98.0 - 194.5.98.255
netname: Privacy_Online
descr: Longyearbyen, Svalbard und Jan Mayen
country: SJ
admin-c: RA9926-RIPE
tech-c: RA9926-RIPE
org: ORG-NFAS6-RIPE
status: ASSIGNED PA
mnt-by: inter-cloud-mnt
created: 2019-04-26T16:42:54Z
last-modified: 2020-03-13T23:11:55Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

WarzoneRAT

Link:

https://www.capesandbox.com/analysis/16079/

Detection(s):

SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL

Detection:

avemaria

Link:

https://mwdb.cert.pl/sample/be66827292b98575cb69b0898954699f52c491ddb0bc8c613a70d20fb3871657/

Threat name:

ByteCode-MSIL.Infostealer.Fareit

Status:

Malicious

First seen:

2020-06-29 09:03:05 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xztie4usxgcxls3jwceysvdjt5jmjeo5wc6iyyj2odja7m4hczlq._file

Verdict:

malicious

Label(s):

avemaria

AveMariaRAT

0c666978e3d3fbfa2fe40db4b7de89d5e4e9d4caeacc33b54ba0311aff72a23b

AveMariaRAT

24bce555546817dc9293da3c7fe25301777f365e008ef2cdd3d979c829287ec6

AveMariaRAT

37d250d71a687db0e2c094fd5932bd32a6198a94b86553580d495cbb592d0f96

AveMariaRAT

433d26c66e7c158b84024a6ee83ad8145598d238ed8855a21a77b8324715c9d8

AveMariaRAT

9d3c04431db8d2630361ac69def49189101a5bf017627be2f147bcd66f3c8d29

AveMariaRAT

d045c6b114f25c29811bbb61864da2f464c9d5195b54d70008b7bbf91384b47f

AveMariaRAT

da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a

AveMariaRAT

e6d6cda38ec798c76fb5727c7af199c496408484c68f3d7c0d34d6be09900ca0

AveMariaRAT

fa925870975e7c53ec50032872d0c8f7aa23d7832658def21887419f288cbd18

AveMariaRAT

+ 536 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence spyware

Link:

https://tria.ge/reports/200629-dqgbrexqbj/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Drops file in Program Files directory

Suspicious use of SetThreadContext

Drops file in System32 directory

Modifies WinLogon

Loads dropped DLL

Reads user/profile data of web browsers

Sets DLL path for service in the registry

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Codoso_Gh0st_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	Codoso_Gh0st_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Codoso APT Gh0st Malware
Reference:	https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	win_ave_maria_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_malumpos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com