MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be9af0fdc2439628d89ec49342567c6718dba2444972b173e652268173b8202f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be9af0fdc2439628d89ec49342567c6718dba2444972b173e652268173b8202f
SHA3-384 hash: 577ca12236c3261cf5140f10c27f603ffe8c703f6c902b0cd9e4c83d13e9262bdb3f66910a992b945d94c84cc64b795f
SHA1 hash: f1daf66c43e999489cb98af02e5618669b04d42e
MD5 hash: b967e62d09157a49194c0e65d16f6067
humanhash: black-california-tennis-sweet
File name:be9af0fdc2439628d89ec49342567c6718dba2444972b173e652268173b8202f
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'216'400 bytes
First seen:2020-11-07 17:32:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5a498eee87e4d89512a84502f500181f (138 x AveMariaRAT, 57 x RedLineStealer, 7 x CoinMiner)
ssdeep 12288:GIbsBDU0I6+Tu0TJ0N1oYgeOFkA7W2FeDSIGVH/KIDgDgUeHbY1tk2:GIbGD2JTu0GohQDbGV6eH8tk2
Threatray 3'250 similar samples on MalwareBazaar
TLSH AB459ED0377E1407E65325B9FC0FD1606185BDAE9F40A7AF6B3ABC2694A3345A063B07
Reporter seifreed
Tags:AveMariaRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Ursu-6793772-0
Create hunting rule

Win.Malware.Ursu-6914170-0
Create hunting rule

Win.Malware.Ursu-6914171-0
Create hunting rule

Win.Malware.Cryptinject-9785242-0
Create hunting rule

Win.Malware.Daqc-6598201-0
Create hunting rule

Win.Malware.Eclv-9782803-0
Create hunting rule

Win.Malware.Eclv-9782804-0
Create hunting rule

Win.Malware.Eclv-9782973-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file in the %temp% directory
Creating a file
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be9af0fdc2439628d89ec49342567c6718dba2444972b173e652268173b8202f/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 17:37:04 UTC
AV detection:
29 of 29 (100.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x2npb7ociolcrwe6ysjuevt4m4mnxisejfzlc47gkitic45yeaxq._file
Verdict:
unknown
Similar samples:
0954707116de7974c38346f17987886632546664d0933bafd412fb343e408317
AveMariaRAT
45e16f925fd769f19452d415ba3ad69fa6bc5c3e97fef7f048d13f2fabe840c6
AveMariaRAT
5553a7b6943f4c1435ec14ecb41b95029d6f2a94f7f415f660c14bd8b68ab7f9
AveMariaRAT
6c094a18d2ab75c95ffc39399cece2eebdb8064f91cec40226be037fb20f64d9
AveMariaRAT
840fcf3e185f0a54e8f1aee00cbcaa8b452a7f45bedb258e3afef8cb9fd3e0fd
AveMariaRAT
950c5135a82ae668688c83c699fc372e74f2745aae8effd9f87fcae2b4a447be
AveMariaRAT
b9eb219ce57af2c2320bab070cc02c9c1e263b6cf79205a0799129bf29d22a5f
AveMariaRAT
bf4ede92655d037060651e09ac68d10895eb8b30617715173a4237b1776429c0
AveMariaRAT
f9676410bb9da322ef7440edfc31815ff0f0a32f92269770d869f62c8f1ee497
AveMariaRAT
fc43a119f255e01cc5bd1ae95791495a4f92cc0545d64b0bdab72dc126a5dd4e
AveMariaRAT
+ 3'240 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/201108-5qwxzbjsp6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ave_maria_warzone_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments