MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6efb11667620971bfa2b783b75762c69c1bf3fe2cee9bd4ddc51164e8ba8563. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6efb11667620971bfa2b783b75762c69c1bf3fe2cee9bd4ddc51164e8ba8563
SHA3-384 hash: 49c98c792f533ba99f066e87c128e114177121608820190aeb7c1c14b7672d96d7473e9817586daa8c82fcb8722d2907
SHA1 hash: d865285d686727c6a31191e53e927fd996434d8b
MD5 hash: 9ba682cc846a343943ca6fd5c5d556ed
humanhash: whiskey-july-april-tango
File name:DHL_119040 RECEIPT DOCUMENT,PDF.EXE
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:801'792 bytes
First seen:2021-09-15 14:08:32 UTC
Last seen:2021-09-15 15:10:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 459f402db2809e477a1dda0946703c4f (2 x RemcosRAT, 2 x Formbook, 1 x AveMariaRAT)
ssdeep 24576:e0KXbYUlmM/OwPVPZzKHrCHW2h8DAaTY2kjpPPobRf+0awpxh9aWRZEfhqdrpXeW:eZmMjxVW2h8DAaTY2kjpPPobRf+0awpm
Threatray 1'688 similar samples on MalwareBazaar
TLSH T1F7058EB1CA46DB72E82E1A3E4DE63829AE26FE403E1CDC119BF0DA7556347512C7D04B
dhash icon fae5d39a443434c4 (2 x RemcosRAT, 2 x Formbook, 1 x AveMariaRAT)
Reporter cocaman
Tags:AveMariaRAT DHL exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL_119040 RECEIPT DOCUMENT,PDF.EXE
Verdict:
Malicious activity
Analysis date:
2021-09-15 14:14:43 UTC
Tags:
installer
Link:
https://app.any.run/tasks/788c692e-1368-48fb-8379-54f24b02cd8d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/188213/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.22177.15654.19089.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61751b68a9d585e6d5370fe2/reports/b901b50c-a83a-4f15-9737-5b703bdbb229/overview
Malware family:
AVE_MARIA
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4cbadf07-acde-4b72-a140-d3c8039a8bf2
Result
Threat name:
AveMaria UACMe
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/851488
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates a thread in another existing process (thread injection)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides user accounts
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected AveMaria stealer
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 483920 Sample: DHL_119040 RECEIPT DOCUMENT... Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 60 Found malware configuration 2->60 62 Malicious sample detected (through community Yara rule) 2->62 64 Multi AV Scanner detection for dropped file 2->64 66 8 other signatures 2->66 8 DHL_119040 RECEIPT DOCUMENT,PDF.EXE 1 17 2->8         started        13 Cjjvnjqh.exe 14 2->13         started        15 Cjjvnjqh.exe 17 2->15         started        17 3 other processes 2->17 process3 dnsIp4 44 192.168.2.1 unknown unknown 8->44 46 onedrive.live.com 8->46 52 2 other IPs or domains 8->52 42 C:\Users\Public\Libraries\Cjjvnjqh.exe, PE32 8->42 dropped 80 Writes to foreign memory regions 8->80 82 Allocates memory in foreign processes 8->82 84 Creates a thread in another existing process (thread injection) 8->84 19 secinit.exe 4 4 8->19         started        48 onedrive.live.com 13->48 54 2 other IPs or domains 13->54 86 Multi AV Scanner detection for dropped file 13->86 88 Injects a PE file into a foreign processes 13->88 23 mshta.exe 1 13->23         started        50 onedrive.live.com 15->50 56 2 other IPs or domains 15->56 25 mshta.exe 15->25         started        file5 signatures6 process7 dnsIp8 38 C:\ProgramData\images.exe, PE32 19->38 dropped 68 Contains functionality to inject threads in other processes 19->68 70 Contains functionality to steal Chrome passwords or cookies 19->70 72 Contains functionality to steal e-mail passwords 19->72 78 2 other signatures 19->78 28 powershell.exe 22 19->28         started        30 powershell.exe 19->30         started        32 images.exe 19->32         started        58 ugob.ddns.net 79.134.225.69, 49785, 5200 FINK-TELECOM-SERVICESCH Switzerland 25->58 40 C:\Program Files\Microsoft DN1\sqlmap.dll, PE32+ 25->40 dropped 74 Hides user accounts 25->74 76 Adds a directory exclusion to Windows Defender 25->76 file9 signatures10 process11 process12 34 conhost.exe 28->34         started        36 conhost.exe 30->36         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6efb11667620971bfa2b783b75762c69c1bf3fe2cee9bd4ddc51164e8ba8563/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-09-15 14:09:12 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y3x3cfthmiexdp5cw6b3ov3cy2obx476ftxjxvg5yuiwj2f2qvrq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
07915b1a44803fc9bd86d2d9ddad19434440b3d73f5c77f3400c84a935dd0255
AveMariaRAT
204671d989631c99ed12773546e79d980aec9a79922769d13c732fff64325353
AveMariaRAT
3ac1be1ee3013db4347de3cfff22c2a030fcca769ee918ba6c4585e38e43c05a
AveMariaRAT
4757d64431cbf911d9a6cc5b1cd96ee7f733dd0eb05c41f1fa100ba3d354d4a5
AveMariaRAT
4b3e872365db5c5fd41d596837b761900d549c8d70247105b2a3451a34b7e74d
AveMariaRAT
6ecbffba7ebc7a31d27bcbd81a37468d881f34af3a84ca2ca7eacae5b56f23bd
AveMariaRAT
7666f3d19250bc9b6d75e1b081407ea6a71c81f22a2c027d85b6445a65a0f247
AveMariaRAT
8ba4ad166994c100c26c0ba03030f7dd583a5ef90dca076963b8710b406f76ec
AveMariaRAT
+ 1'678 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer persistence rat
Link:
https://tria.ge/reports/210915-rf5rtaage8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Executes dropped EXE
Warzone RAT Payload
WarzoneRat, AveMaria
Malware Config
C2 Extraction:
ugob.ddns.net:5200
Unpacked files
SH256 hash:
519197f521aa39b7a7ab34b4500a304a7329d967115c2e48fe1b6eb201e39af1
MD5 hash:
3da921c9355d01d335cf03159a950030
SHA1 hash:
3be3f4ea8f289a123dcd1f6ac97c6f34a503c9cf
Link:
https://www.unpac.me/results/682a6792-56bc-42b4-9d38-56170bff44ca/
SH256 hash:
c6efb11667620971bfa2b783b75762c69c1bf3fe2cee9bd4ddc51164e8ba8563
MD5 hash:
9ba682cc846a343943ca6fd5c5d556ed
SHA1 hash:
d865285d686727c6a31191e53e927fd996434d8b
Link:
https://www.unpac.me/results/682a6792-56bc-42b4-9d38-56170bff44ca/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c6efb1166762/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6efb11667620971bfa2b783b75762c69c1bf3fe2cee9bd4ddc51164e8ba8563

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

iso f6db5403668bc33460530eb17508bb86018e24025aa365c653e9ce24c8d33cdc

AveMariaRAT

Executable exe c6efb11667620971bfa2b783b75762c69c1bf3fe2cee9bd4ddc51164e8ba8563

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 f6db5403668bc33460530eb17508bb86018e24025aa365c653e9ce24c8d33cdc
Cape
Cape
https://www.capesandbox.com/analysis/188213/

Comments