MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0a209c7475d77aab35852ae9662365b1704fdac50b9f3d59daebdee13018942. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0a209c7475d77aab35852ae9662365b1704fdac50b9f3d59daebdee13018942
SHA3-384 hash: e425a91cb91f06c17711d964ad4add9a66389e70647136f174494f8e9c878cf01e9d8549f7a791d4de848404fd45e710
SHA1 hash: 0b00001e2d4eafae6fee18818a150b779fa32c67
MD5 hash: 03bbca98d55e971c5c521442364b69be
humanhash: johnny-missouri-mississippi-river
File name:TgHfUcFlgAAds6e.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:727'552 bytes
First seen:2023-05-10 07:40:20 UTC
Last seen:2023-05-13 22:58:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:6VrB94nZfF5D+H12GJXhwPcT60dJfkhuZuiBcDqV5:6F6NAH15T6+JsheTp
Threatray 3'126 similar samples on MalwareBazaar
TLSH T114F4BF3E50CB5C22C7A5C7FF899869640335BF15ADFBE22E225D30C89DB2BD09A41917
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 02020e8e8e3e304e (5 x RemcosRAT, 1 x RedLineStealer, 1 x AveMariaRAT)
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
AveMariaRAT C2:
85.217.144.17:5200

Intelligence

File Origin
# of uploads :
2
# of downloads :
272
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TgHfUcFlgAAds6e.exe
Verdict:
Malicious activity
Analysis date:
2023-05-10 07:41:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bf578187-aa7e-4355-9a6b-2df65bc9b637

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/388048/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/645b4a95b664422b69d61b39/reports/e73625c1-f226-482c-8f0e-a474517c4e51/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c0a209c7475d77aab35852ae9662365b1704fdac50b9f3d59daebdee13018942
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AVE_MARIA
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a0ac6b9c-74b8-4f8f-99fc-61fe2a1780c9
Result
Threat name:
AveMaria, UACMe
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1229796
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AveMaria stealer
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 862779 Sample: TgHfUcFlgAAds6e.exe Startdate: 10/05/2023 Architecture: WINDOWS Score: 100 117 Snort IDS alert for network traffic 2->117 119 Found malware configuration 2->119 121 Malicious sample detected (through community Yara rule) 2->121 123 13 other signatures 2->123 12 TgHfUcFlgAAds6e.exe 7 2->12         started        16 images.exe 2->16         started        18 aTafEHHXGZUYFI.exe 5 2->18         started        process3 file4 101 C:\Users\user\AppData\...\aTafEHHXGZUYFI.exe, PE32 12->101 dropped 103 C:\...\aTafEHHXGZUYFI.exe:Zone.Identifier, ASCII 12->103 dropped 105 C:\Users\user\AppData\Local\...\tmp2942.tmp, XML 12->105 dropped 107 C:\Users\user\...\TgHfUcFlgAAds6e.exe.log, ASCII 12->107 dropped 139 Uses schtasks.exe or at.exe to add and modify task schedules 12->139 141 Adds a directory exclusion to Windows Defender 12->141 143 Injects a PE file into a foreign processes 12->143 20 TgHfUcFlgAAds6e.exe 5 5 12->20         started        24 powershell.exe 21 12->24         started        26 schtasks.exe 1 12->26         started        28 images.exe 16->28         started        31 schtasks.exe 16->31         started        33 images.exe 16->33         started        145 Multi AV Scanner detection for dropped file 18->145 147 Machine Learning detection for dropped file 18->147 35 aTafEHHXGZUYFI.exe 18->35         started        37 schtasks.exe 18->37         started        signatures5 process6 dnsIp7 97 C:\ProgramData\images.exe, PE32 20->97 dropped 99 C:\ProgramData\images.exe:Zone.Identifier, ASCII 20->99 dropped 125 Increases the number of concurrent connection per server for Internet Explorer 20->125 127 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->127 39 images.exe 5 20->39         started        42 conhost.exe 24->42         started        44 conhost.exe 26->44         started        113 helpme20.duckdns.org 85.217.144.17, 49696, 49697, 5200 WS171-ASRU Bulgaria 28->113 129 Installs a global keyboard hook 28->129 46 cmd.exe 28->46         started        50 conhost.exe 31->50         started        52 cmd.exe 35->52         started        54 conhost.exe 37->54         started        file8 signatures9 process10 dnsIp11 131 Multi AV Scanner detection for dropped file 39->131 133 Machine Learning detection for dropped file 39->133 135 Adds a directory exclusion to Windows Defender 39->135 137 Injects a PE file into a foreign processes 39->137 56 powershell.exe 39->56         started        58 schtasks.exe 39->58         started        60 images.exe 39->60         started        115 192.168.2.1 unknown unknown 46->115 109 C:\Windows\SysWOW64\dismcore.dll (copy), PE32 46->109 dropped 111 C:\Users\user\AppData\Local\...\dismcore.dll, PE32 46->111 dropped 62 PkgMgr.exe 46->62         started        64 PkgMgr.exe 46->64         started        66 PkgMgr.exe 52->66         started        68 PkgMgr.exe 52->68         started        file12 signatures13 process14 process15 70 conhost.exe 56->70         started        72 conhost.exe 58->72         started        74 Dism.exe 62->74         started        76 Dism.exe 66->76         started        process16 78 images.exe 74->78         started        81 conhost.exe 74->81         started        83 conhost.exe 76->83         started        85 aTafEHHXGZUYFI.exe 76->85         started        signatures17 149 Adds a directory exclusion to Windows Defender 78->149 151 Injects a PE file into a foreign processes 78->151 87 powershell.exe 78->87         started        89 schtasks.exe 78->89         started        91 images.exe 78->91         started        process18 process19 93 conhost.exe 87->93         started        95 conhost.exe 89->95         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0a209c7475d77aab35852ae9662365b1704fdac50b9f3d59daebdee13018942/
Threat name:
ByteCode-MSIL.Trojan.RemLoader
Create hunting rule
Status:
Malicious
First seen:
2023-05-10 07:41:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycratr2hlv32vm2ykkxjmyrwlmlqj7nmkc47hvm5v2664eybrfba._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0211f1dc94407a86459131e36dcffe165c9329eaac37c195701817260a3e01d6
AveMariaRAT
1a3b961a9b5d76e0028382423f14a35192cda3d3a6dee88fb812c90b1971bf2a
AveMariaRAT
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
AveMariaRAT
55e427b25c25bcfe1b0975adba359a3790ebdbc0f2e065d3e0c84ccda77d5c1a
AveMariaRAT
57ff6de510ccaa060efa53e2c9e1c1b8c3b132fa55289a8a7ecc321a5370043a
AveMariaRAT
68de9f9de58cc646734a635dc1c3b3a6747a7ebf746f3a4910d130ddc52c38d1
AveMariaRAT
8e3f656f70978440245c238870f316ccdbfbadff73350dd6d204c9035cc00357
AveMariaRAT
abbf85558290e3fa302f88f51243e5216f24c9bc4fce64a0f616db3be2c46e8e
AveMariaRAT
e5615a6c90478a371040d8f7d4721e183b5efcc0b0e6ce64b7ab4ee1d04bf0be
AveMariaRAT
+ 3'116 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer persistence rat
Link:
https://tria.ge/reports/230510-jh4njagg2s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Warzone RAT payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
helpme20.duckdns.org:5200
Unpacked files
SH256 hash:
b302e7c4bcadb1bb01c03cb0b3dffc5cead196ea312a31611f4fcc67b65f5ce3
MD5 hash:
b525f4914ab16584ffd93bc91ef41d43
SHA1 hash:
b5f277add8a23a7c6e2d21702cbfd468eed47d5c
Link:
https://www.unpac.me/results/f07c998a-e35c-422b-b046-08fceee1798d/
SH256 hash:
d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218
MD5 hash:
e5d93dadd08b8bc727e4f4853c6881ba
SHA1 hash:
27e0e057d33f01586193b0cbf06561c2863951f4
Link:
https://www.unpac.me/results/f07c998a-e35c-422b-b046-08fceee1798d/
SH256 hash:
5bf18333a936e0f430a0e52390060b2ea35d472bd88b1cf8299e6502e7365140
MD5 hash:
2bd1a8683a3c9993feab5f972368a5ae
SHA1 hash:
247eb4a1214e77f62e4746adae9cf31436257bdb
Link:
https://www.unpac.me/results/f07c998a-e35c-422b-b046-08fceee1798d/
SH256 hash:
c0a209c7475d77aab35852ae9662365b1704fdac50b9f3d59daebdee13018942
MD5 hash:
03bbca98d55e971c5c521442364b69be
SHA1 hash:
0b00001e2d4eafae6fee18818a150b779fa32c67
Link:
https://www.unpac.me/results/f07c998a-e35c-422b-b046-08fceee1798d/
Malware family:
Warzone
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c0a209c7475d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0a209c7475d77aab35852ae9662365b1704fdac50b9f3d59daebdee13018942

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/388048/

Comments