MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4455526cf7405d73b9921ccbfc495da018d97d12ae5590d20720894a88b4d72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4455526cf7405d73b9921ccbfc495da018d97d12ae5590d20720894a88b4d72
SHA3-384 hash: e6182a1a6ae1d0b1a3e633c5f85ee202cecf27e6ddaee995c5609fdc218f02f7a8ede172591bb5eb0a92b5c8c105e7f8
SHA1 hash: 958b8a1c18e391e64cc3ad94758ce80fa7439bef
MD5 hash: 0a133f133a1ad43e4ca156fed4de530c
humanhash: nine-lithium-fruit-spring
File name:c4455526cf7405d73b9921ccbfc495da018d97d12ae5590d20720894a88b4d72.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'095'168 bytes
First seen:2020-04-13 17:18:04 UTC
Last seen:2020-04-13 17:48:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cfe72f0b2fd3a569e9ad63b0d57aecbb (1 x AveMariaRAT)
ssdeep 12288:hwmMDNp/iiduuxCQHOWWk4kfUsYOVCQHtmoJ2lkgwxw:1MDjqWN4kfUsYOCU1a
Threatray 831 similar samples on MalwareBazaar
TLSH 18353901B7A0D024F8F716FA85BF717C593DBAE11314A0D751C06AEDAA64AE0BC32B57
Reporter JoulK
Tags:avemaria AveMariaRAT RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.38496.17081.15072.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Avemaria
Create hunting rule
Status:
Malicious
First seen:
2020-04-13 03:20:02 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
23 of 44 (52.27%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yrcvkjwpoqc5oo4zehgl7rev3iay3f6rflsvsdjaoiejjkeljvza._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0c666978e3d3fbfa2fe40db4b7de89d5e4e9d4caeacc33b54ba0311aff72a23b
AveMariaRAT
19fa55d64a5d0900b5f8604bb765ab9196e07b2716f1248e0a8c6245e12e2119
AveMariaRAT
4fa4af45c70295513c486589c0e36e7436be6abbf3c75e97b544db959e9dfcb5
AveMariaRAT
62a9e0bc56c03b9ad7ff3ff1242415b95c29b10c2699a55c4d8940338e18887e
AveMariaRAT
8e944862dbed48bf69c402e4d8b58b87092b9154e127f6786ef47132148177b7
AveMariaRAT
9d3c04431db8d2630361ac69def49189101a5bf017627be2f147bcd66f3c8d29
AveMariaRAT
da103e7998ff3ffd61f85d819dc90514d910c30a0d2e9ee6c071001f9137161a
AveMariaRAT
da1305da0ae76ad97c57d683d406bb1c45bc112199504df3eb6e62b516696e6a
AveMariaRAT
e6d6cda38ec798c76fb5727c7af199c496408484c68f3d7c0d34d6be09900ca0
AveMariaRAT
e97d4cbbbb923b04cee8f87235ad15ab83a7cba51984422cdfdcfefa7e81d457
AveMariaRAT
+ 821 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_ave_maria_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetNamedSecurityInfoW
ADVAPI32.dll::GetSecurityInfo
ADVAPI32.dll::GetAce
ADVAPI32.dll::GetSecurityDescriptorSacl
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetKernelObjectSecurity
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::RemoveDirectoryW

Comments