MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795
SHA3-384 hash: 80df28698395de6a04a4a05317530e5e47caaffb2a441e48c2fdddeb47b81edcc3a4e74d5638a53518d6814e37a303f1
SHA1 hash: 520fb8f8467705516c4af1520a5a16a9e8de8e33
MD5 hash: 31501e635b9f936ee985b4cf4aec2b3c
humanhash: lake-washington-pasta-alpha
File name:c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:714'312 bytes
First seen:2023-03-06 14:22:58 UTC
Last seen:2023-03-06 15:31:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 12288:aFfNPXhuc7mri46RZ6wpqA2D6IAe8hAr33msfX2A4M4rNm4i5h:4fkym58MXb8ghuLMANm4Mh
Threatray 281 similar samples on MalwareBazaar
TLSH T1B3E4235174C1D4AFE10AC4FC8DB86AA8F6AC6D040B13A543BF553FAAAE35E41C6CD361
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 7260c8c8e868f1e9 (2 x AveMariaRAT, 1 x GuLoader)
Reporter adrian__luca
Tags:AveMariaRAT exe signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-02-24T08:31:15Z
Valid to:2025-02-23T08:31:15Z
Serial number: 24580f60131f6dea8c51bd4437da7ac493b53c2a
Thumbprint Algorithm:SHA256
Thumbprint: 3149830a59d8c8f8e233ec603a3e6f2c75089f1b090198f15a72168c9a2bc515
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
240
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795
Verdict:
Malicious activity
Analysis date:
2023-03-06 14:22:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d17b1911-8c7a-4624-a2d5-9992795c9f45

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/372022/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65660918.19115.28222.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file
Delayed reading of the file
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer guloader overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6405f7485961badabfa9bd0e/reports/38b1e7ba-e0d4-4431-afff-e29b29f2e0ae/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/74cb6a5d-0df4-4fa8-a6b2-17663a3aca63
Result
Threat name:
AveMaria, GuLoader, UACMe
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1188041
Signature
Adds a directory exclusion to Windows Defender
Contains functionality to hide user accounts
Drops PE files to the document folder of the user
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Increases the number of concurrent connection per server for Internet Explorer
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect Any.run
Yara detected AveMaria stealer
Yara detected GuLoader
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 12092 Sample: j39SN7IRMc.exe Startdate: 06/03/2023 Architecture: WINDOWS Score: 100 72 googlehosted.l.googleusercontent.com 2->72 74 drive.google.com 2->74 76 doc-10-ac-docs.googleusercontent.com 2->76 88 Malicious sample detected (through community Yara rule) 2->88 90 Multi AV Scanner detection for submitted file 2->90 92 Yara detected GuLoader 2->92 94 3 other signatures 2->94 12 j39SN7IRMc.exe 1 49 2->12         started        16 Windows.exe 30 2->16         started        signatures3 process4 file5 62 C:\Users\...behaviorgraphPUPowerSavingConfigEditor.dll, PE32+ 12->62 dropped 64 C:\Users\user\AppData\Roaming\...\sqlite3.dll, PE32 12->64 dropped 66 C:\Users\user\AppData\Local\...\System.dll, PE32 12->66 dropped 108 Drops PE files to the document folder of the user 12->108 110 Adds a directory exclusion to Windows Defender 12->110 112 Tries to detect Any.run 12->112 18 j39SN7IRMc.exe 5 11 12->18         started        68 C:\Users\user\AppData\Local\...\System.dll, PE32 16->68 dropped 114 Hides threads from debuggers 16->114 23 Windows.exe 2 8 16->23         started        signatures6 process7 dnsIp8 78 googlehosted.l.googleusercontent.com 172.217.168.1, 443, 49810 GOOGLEUS United States 18->78 80 drive.google.com 216.58.215.238, 443, 49808, 49827 GOOGLEUS United States 18->80 56 C:\Users\user\Documents\Windows.exe, PE32 18->56 dropped 58 C:\Users\user\...\Windows.exe:Zone.Identifier, ASCII 18->58 dropped 96 Adds a directory exclusion to Windows Defender 18->96 98 Tries to detect Any.run 18->98 100 Increases the number of concurrent connection per server for Internet Explorer 18->100 102 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->102 25 Windows.exe 30 18->25         started        29 powershell.exe 23 18->29         started        82 142.250.203.97, 443, 49828 GOOGLEUS United States 23->82 104 Hides threads from debuggers 23->104 31 cmd.exe 23->31         started        file9 signatures10 process11 file12 60 C:\Users\user\AppData\Local\...\System.dll, PE32 25->60 dropped 106 Multi AV Scanner detection for dropped file 25->106 33 WerFault.exe 21 16 25->33         started        36 conhost.exe 29->36         started        38 sdclt.exe 31->38         started        40 conhost.exe 31->40         started        42 sdclt.exe 31->42         started        44 sdclt.exe 31->44         started        signatures13 process14 dnsIp15 70 192.168.11.1 unknown unknown 33->70 46 control.exe 38->46         started        process16 process17 48 Windows.exe 46->48         started        file18 54 C:\Users\user\AppData\Local\...\System.dll, PE32 48->54 dropped 84 Tries to detect Any.run 48->84 86 Hides threads from debuggers 48->86 52 Windows.exe 48->52         started        signatures19 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795/
Threat name:
Win32.Trojan.Nsisx
Create hunting rule
Status:
Malicious
First seen:
2023-02-26 14:56:47 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
8 of 39 (20.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymszirrzpyhaqqidcdvkc7esa27s6pkderguk34mxgu34kf4e6kq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
1618cd5f5490038c34e179710ad15803a6549955b22a9d83b4f60eeccb7f2975
AveMariaRAT
3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f
AveMariaRAT
723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef
AveMariaRAT
a7fb5c3347daf214fbdbec78aeb30ca90c09726b6aa7cfb929a563ada0d49d7f
AveMariaRAT
dc5da53a5e93a588335b6561258d1540ac7d696c633d03de92e72d8e53254234
AveMariaRAT
e1ac514b5cc907df4f0a6ed89cb6f17827302f89fd4cb95d8f8606b4d2e54d5b
AveMariaRAT
ef56f8c0615d059de3d0f669b651d38caf535155878ff4bc7d1b1a62abd45213
AveMariaRAT
f34af4e240968da5243075917a094299d81806908f1eccec9ef7aeb6ebbbb21a
AveMariaRAT
+ 271 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:warzonerat downloader evasion infostealer persistence rat upx
Link:
https://tria.ge/reports/230306-rp5s6scb7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Modifies WinLogon
Checks QEMU agent file
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
UPX packed file
Modifies Windows Firewall
Sets DLL path for service in the registry
Warzone RAT payload
Guloader,Cloudeye
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
wtwrrtxhssbqsm-fk.duckdns.org:3630
Unpacked files
SH256 hash:
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 hash:
0063d48afe5a0cdc02833145667b6641
SHA1 hash:
e7eb614805d183ecb1127c62decb1a6be1b4f7a8
Link:
https://www.unpac.me/results/504342dc-dcbe-49cc-8e88-e8ff64ce8ea8/
Parent samples :
5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
02fca6ef5d9d8b1eb29f7ac8ea0573b504ea7f06c215e091791653b40fe1329a
cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427
045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee
f2a883a0e4b01c72b0f063df3be5a0102e5c8fbaedc39c8d35c632b200599283
dffefbde27442b9095388b1871ffdc101c430b9a814138be4f962328a5b73fde
e0fb60da371912c158861c9660632d58e45cfcff12351cc9e03f497f319eb5de
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a
SH256 hash:
cf11409c81b426b1e900c0af603fa1835dc5a646fe6d8f7fb582e80af1122bf2
MD5 hash:
901228029213372f1301f06a8a3b41d2
SHA1 hash:
8e9b038e98323a9af5c57b4966187942ce258ba1
Link:
https://www.unpac.me/results/504342dc-dcbe-49cc-8e88-e8ff64ce8ea8/
SH256 hash:
c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795
MD5 hash:
31501e635b9f936ee985b4cf4aec2b3c
SHA1 hash:
520fb8f8467705516c4af1520a5a16a9e8de8e33
Link:
https://www.unpac.me/results/504342dc-dcbe-49cc-8e88-e8ff64ce8ea8/
Malware family:
Warzone
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c3259446397e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3259446397e0e08410310eaa17c9206bf2f3d43244d456f8cb9a9be28bc2795

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/372022/

Comments