MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c
SHA3-384 hash: 7fb71603749abf7af742a791e9be6d709afad67c0fb4aae639043c97f53d8f5d09c8698a4c80d6d86481d4de724a2b8b
SHA1 hash: 01ad46f4b2f4454216c9ea7fd2597b652ecfbc32
MD5 hash: cc095a3e639c7eb26fd4ad16bca2626c
humanhash: illinois-oranges-solar-april
File name:be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:260'192 bytes
First seen:2020-06-29 07:29:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 3072:GK7e6eq20s4hvkXSCJdQl//PrKt5KaUEeCJE1OAMTzA6QZki5l7AmMjkVl5w:GKS/0XhvOhJdMjuGfAEwjQSi5zLHm
Threatray 539 similar samples on MalwareBazaar
TLSH AC44BF277298AF03CBAF15FF8081514443B1A55E7383F3CA5CD254E926D67D31AA2E8B
Reporter JAMESWT_WT
Tags:AveMariaRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15673/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 05:47:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzxw66gjltlooxhhx4ggipj2zx3ov5unl3is2c6w75y7eighczoa._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011
AveMariaRAT
2392838d6d73a8d9675bbce1e1e5b6e81900a9fc0c2bbd49bd432095b5eafcb2
AveMariaRAT
3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68
AveMariaRAT
5d2205a9b13efc7fc35da49a6944ba14a1d4eabea7384cd131159c30d8b6d931
AveMariaRAT
8ad9862548bf4d19b6e8efc18a0a54a359cc4f11a7f4bfac1a3029b853fa6e0e
AveMariaRAT
a17ef004c92a31609e352f1d1d70b3f052093b6a1801fa5793627db80f8c43c3
AveMariaRAT
bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b
AveMariaRAT
d83477583d6618efda4a6bf58dc2ba734cfb0c3be49818655d0e13cb675b5c3d
AveMariaRAT
e97ad9350f9b4af8a80c4853f0380f5177be6d18505650220703387a59448577
AveMariaRAT
ea8b31057b96e014214275c5de49dd66c22ac523098100b6ec624384a2f9b35d
AveMariaRAT
+ 529 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-7989z1f1y2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15673/

Comments