MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 19


Intelligence 19 IOCs 1 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92
SHA3-384 hash: 79878bb128769cdcb530b9c8375fd3b03fe905d70823e38c8588afcaf3becf8e1f5902fc9bf47267271f2b1068ebfab8
SHA1 hash: cca987129e4a7ce3a9853e419ccdac32130310d3
MD5 hash: 06fe875e4701de15eb98fef1e228d32b
humanhash: friend-jersey-oranges-vermont
File name:06fe875e4701de15eb98fef1e228d32b.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:624'648 bytes
First seen:2024-11-25 03:50:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:NqrK4A9bRZmqRiYmeTLBxg6NEtuhc07M6qAvqp9YfvkR:UrKHmqnmiLBx5NEYhcmM6q8qp2q
Threatray 3'440 similar samples on MalwareBazaar
TLSH T143D4E06023EC9F24E57EBBF2A17521155BB3392A1670DA0E0DDD60DB1673B80CA61F63
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon 00a6c8e0e2c82402 (1 x AveMariaRAT)
Reporter abuse_ch
Tags:AveMariaRAT exe RAT


Avatar
abuse_ch
AveMariaRAT C2:
176.223.112.134:4268

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
176.223.112.134:4268 https://threatfox.abuse.ch/ioc/1347128/

Intelligence

File Origin
# of uploads :
1
# of downloads :
532
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
avemaria
Create hunting rule
ID:
1
File name:
06fe875e4701de15eb98fef1e228d32b.exe
Verdict:
Malicious activity
Analysis date:
2024-11-25 03:51:08 UTC
Tags:
rat avemaria remote warzone stealer
Link:
https://app.any.run/tasks/0a8e87f9-1ac0-4a7f-aa3a-ff0fdbfa8202

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Barys-10037593-0
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6743f427d0583382434af6e5
Tags:
virus shell msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching cmd.exe command interpreter
Connection attempt
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Setting a keyboard event handler
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys cmd lolbin packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/6743f426fcae1d619b4ea299/reports/ac8d374f-6564-46a0-9411-0a198464c248/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92
Malware family:
AVE_MARIA
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/054c6ba9-09a6-4592-b0d4-4c6bf9bc245a
Result
Threat name:
AveMaria, PrivateLoader, UACMe
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1562025
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if Internet connection is working
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates a thread in another existing process (thread injection)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected AveMaria stealer
Yara detected PrivateLoader
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1562025 Sample: H4IoDDh3Rv.exe Startdate: 25/11/2024 Architecture: WINDOWS Score: 100 39 Suricata IDS alerts for network traffic 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 11 other signatures 2->45 8 H4IoDDh3Rv.exe 4 2->8         started        process3 file4 27 C:\Users\user\AppData\...\H4IoDDh3Rv.exe.log, ASCII 8->27 dropped 47 Contains functionality to hide user accounts 8->47 49 Contains functionality to check if Internet connection is working 8->49 51 Contains functionality to inject threads in other processes 8->51 53 4 other signatures 8->53 12 H4IoDDh3Rv.exe 3 20 8->12         started        17 powershell.exe 23 8->17         started        signatures5 process6 dnsIp7 37 176.223.112.134, 4268, 49737 PLI-ASCH Belize 12->37 29 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->29 dropped 31 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 12->31 dropped 33 C:\Users\user\AppData\Local\Temp\nss3.dll, PE32 12->33 dropped 35 3 other files (none is malicious) 12->35 dropped 55 Contains functionality to hide user accounts 12->55 57 Tries to harvest and steal browser information (history, passwords, etc) 12->57 59 Writes to foreign memory regions 12->59 63 5 other signatures 12->63 19 cmd.exe 1 12->19         started        61 Loading BitLocker PowerShell Module 17->61 21 WmiPrvSE.exe 17->21         started        23 conhost.exe 17->23         started        file8 signatures9 process10 process11 25 conhost.exe 19->25         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92
Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92/
Threat name:
ByteCode-MSIL.Trojan.Jalapeno
Create hunting rule
Status:
Malicious
First seen:
2024-11-22 13:08:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zqh5w2kgv7irsf2yrtsern2s4p2j326nbhjojvwg2bgmdxdxj2ja._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
unknown_loader_037
Create hunting rule
Similar samples:
3eaf9b1988ad1983591b49b12dfa7590c2906491421d9e544c75388cbca2353c
AveMariaRAT
419bd2e8c8f37d8aff13f7b3d3c2238ac3cd5d33d9002e696c94ca25ae4d036b
AveMariaRAT
449d68f816f777220922b061ddd7b58a5ad931b7fed71a7e8aa0e31ffa8c004a
AveMariaRAT
644903e3c3b1abff0f405b7e9f8f7a94782fa8b3624912cb33255407e849eadb
AveMariaRAT
87576351067ea79fe0acb467ddb9c29ddce87f1179c0de4519df93bfad53dfe0
AveMariaRAT
b1dd88d731db2c74fcaab338a9778f813bac4c2d6597237dc634fe086c829fd5
AveMariaRAT
d9db59d346e230c873e73efb39d891b61e8026f3307772948974011989108be5
AveMariaRAT
error
AveMariaRAT
+ 3'430 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat collection discovery execution infostealer rat spyware stealer
Link:
https://tria.ge/reports/241125-eegx5sxjet/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Warzone RAT payload
WarzoneRat, AveMaria
Warzonerat family
Malware Config
C2 Extraction:
176.223.112.134:4268
Verdict:
Suspicious
Tags:
WarzoneRAT
YARA:
n/a
Link:
https://app.threat.zone/submission/714bb448-6641-4173-9d77-f9b3399736be
Unpacked files
SH256 hash:
c49c12e3783689a95935ebfa1ed1f7828539e41a373ef312312306ed3f18d81c
MD5 hash:
46ffa0cc97e617c83b2c5c7fd2394caf
SHA1 hash:
e8a23ab87fbe1921d32e5012c76c1b60f5a46dad
Detections:
Warzone
Create hunting rule
win_ave_maria_g0
Create hunting rule
AveMaria
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
Codoso_Gh0st_1
Create hunting rule
MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
MALWARE_Win_AveMaria
Create hunting rule
MALWARE_Win_WarzoneRAT
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Codoso_Gh0st_2
Create hunting rule
potential_termserv_dll_replacement
Create hunting rule
Link:
https://www.unpac.me/results/2507f992-6086-4701-8086-162bad1f5308/
SH256 hash:
47588317ad72652a3beeed894bad0b5537b0bcdd6a8d12767d307f9b6dd4d560
MD5 hash:
67df96eda1200e99256e9cd56f6cc934
SHA1 hash:
8f5b876376ec3cddfee268f2960e4dc245e75248
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/2507f992-6086-4701-8086-162bad1f5308/
SH256 hash:
42845ecc42abd302d832179057f11d269f8c7ce4bf324d256f35f5bca1ca45b6
MD5 hash:
0da34a44ee4876dd5e35939af02f1d32
SHA1 hash:
83109ca5bd5178b9f409a2eeb14dc0763df57729
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/2507f992-6086-4701-8086-162bad1f5308/
Parent samples :
6968d52cfb23011d71a62b5b5f7a58f98bf287503af1dbb9d13d21998d1de6ed
ffc6b173f9b255702bdcbe65dd606f6154865c7fea2b2488305ba8f0d9ccef58
990e32f2b58b0c11d9998695169ab6a6b0825fc2c4c70d366eb2197360875edc
f303f80350d34a05961ace4456cc3408510a36852b94a75e0e9abfcd75f803b6
60fc7c50aff42fbe59f51bcec55bd48ef9e78025d471f26051907572cced5ef5
acbd111f6e01f7a02777bf50b95d61a352d476f031e7421f1fb356454a81e4e2
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4
4362b2639911cd4589bc5704aa5dac8f47bed2ab7d893b375cb74743ad38c3e1
c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155
38d921d063a0fb892086121bb34180b2a930819788a3e34a0d2f65224142d930
d709e53e4afc4e29076812e41282fe82bcf2f3d73abe7016f13a41f432f4bd75
5eabc2ee89814722a4e157224e042211e7780ab450b8ed1f9311f72eb80f4262
f8651bad204cbf1299c8143c5fafb19346e11203273b76483aba23a0c91a6bbf
eaee2e889db67e2b31b9297c371542028cab1b572270e85757a0a4849cd004aa
c997ad9cac5cb1cfc050a066e275aae6a540443075b2641ca19331b3f065ee29
2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9
8e63fcd9e5fcdd993a7535a3990f28a4c95740d801dbfde8fb0d338bbae22d4c
5e8880438f921f4bd81f137cc9b4c44f1ba12b321a178d4d50a0601d75aef049
4bffa4186f899e3474a07b07fa5caaec795250cfe89d4c24b9369e2da967238f
b22bdf76891cde5dd78a3f1dbc7ad67543f9d66db4a959bf3dc70536d8d1903b
9565e0e3358341d167b1adfe5a30b957aa028e19addb4427af1bbd41bfe67e6b
901f5ee695e32164bd5fa37b4d6ee86680c435aafdb9d504864b5d70d3da9983
e70f87d5f05ff21f16c25173755ebb71a2cf2b46c047aa9ad9bbf1e13e2dd3c4
f3246d0ca5ca8e69f98ca33b2c17813d5d862049dcfa9931dbcbaaaf7543a1f7
d6186fa8bede1688696983f91284af10a7d8db6f28387d08c3d125853a0c93ab
76ee39157442dc28e64f089260ca42ec5374ae2fccb99d0940b9717e48e6dc86
43504fb57bd1ac94288d4f43963b862b3bcd530397bd7584f14ade877a31a8c8
6f5c8e04089a2db3aaa4d9447de589e5df8899292fbc70a5ad852d7abc7f174e
d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca
05686f0f36d10b7c3056592eba7b16959f1940268ca9979c2312c50b8a73e045
f03acdb2a846f8060d76c3d81651949b5699a5dee5b2b26ec238872defd12252
01921eaf53c9afa578c6abce6daf8fd661d8be6467c589816785ff39f3545503
f69515024de365946c3a58ce3315898196dcca5a2d5a9ba3f5b257818df4055a
2efd54686c3942f7778ae4ad63c002e50d1fd2a08fac36ac770dff40cb3e3788
7bd9596f753e58ba917ba418c191af8fcb9b537e73ee6a86989960099585394f
6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973
50603d9481c76ac7052a18320666f9206f6729c78fdb779c0e7010952eaede26
819453cf1ae051083e60fc82a6125798ab8f94385d65bb2c1920cb7579df6772
2f5f280877cc85b590b53a0b6c2d061b34a6d23629cca5ea0e0aeb0591ef3b0e
89bf888148eae2caabdc6d3fff98054127b197b402493581894a3104ed6b6f1c
5cce0ced936e5d9c13d6a4a8a3c149371c92236eb4c465e0e422142946509cea
a83b6e776af937398296eb1b06b65e9ea8226693b5a8337f35c8b8e42bebb23b
3f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295
8c25a42242f041b0ecfc47164ef25a988b37735dac00a6990f7babd80eaa2487
11013cdd71339c3aac7041ef80912c8c03786f5967d58c539af0d560687089e8
8dd1167ef29a5c350fd3004da6a685cf48c6c587dac25fc4786f9fd90284b5b1
402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361
7292590b86e83ca5c6993b8c56578740d1f066c91baf3d95bee2bd34d9153f15
c35b10fc350209ec356b48282d85b18d9b9ab5c0167dc88461297906602e3d61
429e0fa9706ee65774188e538bda0b69a15fb93e97864cedb88e33c650ed9538
10f6d70d363d93fce85e92f2ea94a36eda4c755606581cd101652afaa97a91fc
f6b094d042f1ccc79ef5060b18495c6bee55585630fac2c3d3f32a8c9c174de6
a36c66fb7fdfb2639cc0ccdeaeef4e6c1a1cd103ba76309ed32777b3f2ab069d
c6324c508e3f4ca77de6321a2ba98faec3cb40ab4b9d85a2eced9560f24f6eb9
4aa26829657bbdb5983129321451365832a69fde42f22687b9a7c598f2e04301
ad3517d5640b93e40bc1e839f6616222801d06dd83ed5887462a71f3858f5b40
e115d3bd2903d9d663a7a69edd08b0ba5f2528c831d17530bbf621648b44894c
bba1825bd893328442cb891a35420a5da41a5431d1ade643f085c5992e763d3a
0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d
bdf6c1caee139afdf9122554e47a2b1f56dd5598447dced5cf81cafac1dfb7a0
c8d717bc9d9c2bd335a79ac5e189d98f36fcd7ab0c62475a7aa7da5fd5ae75d1
941559a78b6e1caf39212048e7f62723e5f283d1942858cc07a339d6d6b24362
cd60ea86b574b6b511ce6a6aff1314ce71b1953e169792e3e76a36913e85ea23
d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec
096b33571e80d18c1763a3bd5d019e3177f1547b3ca6e6205a349075ce2fec18
efbc15ccbe9e7b1f1648d94c5e38e3149bff5d33ad93c0a56e68db648050509a
98ffb783354435168540dc2e8eb4570f865f324169d553ffbad828bf9f33acd3
59586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4
cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3
2e64ed10f0c61a872dbc4cc8ac023e947db0c9642044dbe33af671cff97135a0
5618efb4038198984ccca27de0dd5850a697038d9f0c2a9ad26b17bb26cc0f7b
9c9405332a044a5f3222dfc59bc8b36a4cd6fc4542c8651667aaf2101bb54ea8
e588a098e9ceb33f2616e11a3faf28162e5f4b7f3800b22ab3023bc376aeb18c
04620fd6c4803006181800a7c9dd8748e37e688d197bc22fc580f6d8400c4d13
744ad803081f6ad2d85f3c667c537c6bc3a47bf95c07f496315171790a1b05a2
b3af9675cef7e3a371e7a3d98d141b2bc6cbbc5da2df140dc09cf918ee3c62da
cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92
1070bf3c0f917624660bef57d24e6b2cf982dce067e95eb8a041586c0f41a095
f0430c66223a7084799e61e0cb4541d034da240965e9aa62f2d6994ece64a5da
fbc1981c8c4b453464e63ea2155aa74d2e6e6da1fd3268fd8b45e16c1d2bd0d2
f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b
0d29f5c648cbd373d3b46738e2a00917b156053e4eafb1e47481a122cedf0a1e
ba5fae13322d5151dfb348ac1a2abc92d021617c154ef9d1e4efc70bf7fdf03b
5bda0fc048c68899988ae1d18bffe618d76edc0e02abcf3289018ac1038ff420
SH256 hash:
fc0c90044b94b080f307c16494369a0796ac1d4e74e7912ba79c15cca241801c
MD5 hash:
6b906764a35508a7fd266cdd512e46b1
SHA1 hash:
2a943b5868de4facf52d4f4c1b63f83eacd882a2
Link:
https://www.unpac.me/results/2507f992-6086-4701-8086-162bad1f5308/
SH256 hash:
021d01fe3793879f57a2942664fc7c096710e94e87ad13dc21467c12edf61546
MD5 hash:
ad9fd1564dd1c6be54747e84444b8f55
SHA1 hash:
001495af4af443265200340a08b5e07dc2a32553
Detections:
Codoso_Gh0st_1
Create hunting rule
Codoso_Gh0st_2
Create hunting rule
Link:
https://www.unpac.me/results/2507f992-6086-4701-8086-162bad1f5308/
Parent samples :
41b6843f504506bfe5a47155873b5e8d4a10382e6bcbbaadf069bc5d216c8b53
273c7d66a2746646c43e4c870ea99def6bfb8d7210cafac4eeda64c50b2f8e83
0105bafb9a326de3ee23e8d01a0b0bd3216a3de3906e28c10c3cfa4825939161
426bb510c18d37da520b953e633c1dca9d950b2d8fc06e550cd9cbd1e08d7b2c
4df8c432a1d5153c687b60c3031648c6ac198cf96b44cb15f1d28f758aa213e5
57bcf0394886e8bd03578d317aebab8af7195e007dd1636b266073b282b43848
95a91cc096986a40b10a03f3376eb7de4b3c83e7742b667f7c2f6bef13ccdeb9
661435185812c66992daa150269ffbd8661c06a6d0847cf8b5e49dbdcffb677f
9fc23786a7059b7e7bfb19582fd5f96b91c86812ccc32aa9c7722e85e16590f8
d18059bfd5e9a4d0e07a953fb8c86101ecdf77f9b7e9e80cf6099fb40506bea9
a579e6d169f7af0c31de4c24bd4a8d3e05f46145a5d219850124fd1e11628349
9b550290b925e68da43d0254e187f3bd53d73778e2fec286ebe66db8da1a5dd5
4966546ac0b90d093d0e2ef5666566b76cebae4b6e02f5a6b9f24a56b7ab049f
963750cdc4a1d1586b16d85a4853a5a48d64b5a79d740895ed8aa33afe95f5c4
000dd50b2f3df84aa499e38e8a88994b92c14556c517cd26237eacede1130c3b
c5a55dd1ecb98f43122a554288baa4e7e0ecdb81e30557db4c19fd833f145107
9b91ef0fbd1439f0e7b13a7d234d0574c6db6a07ea1e2842fbe7d2e4ab4042a9
f4e31d0e6efa4955d4023413ce6658406decbb31b954e822b92d31e3c12956de
447263ca2619e641d0a52b475b2de64ae9c852048415e31897bccbcb615c4927
a3980c5f653e99fe53dc88f60a9ca1b4954b8cee932085ea57b1f46b9c7ab4c1
3c36d574e4005d919706e2945a25f6704d48ea69b5960bdc544e59cc4e3295cc
59ee15056c8ca8f240ba10fe20a523e3dc315cc0304f1f1abcb2913d701d4f23
01dbf52c9a79ce268fa7b5ab876ab6c8a8e6d5d5de70ccfacd11ca169e83908a
46a870926fb693596e4fea1ff6ed4bd228d8cc63a9e285997ded48b1484ab3f5
89e0d97c3f6b79962f97e02152cff003f17d940f973d762874576dab2bc3a312
c8731f7db8cff30881c306796850704a66edb90501fad4952822bb09624db618
d2d549d6dd5d017ce1b853932513ec389de11e6443fe466487b2ed2e1528b857
31b26582627d2978052cdce87ae338c2e78a029f7676365e1583c05528afada0
80da1b7360c8d9aa99ae826402e7232f5b2b1112a81bd29765596a60c8502c66
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3
7c8df85e9bea7559e0addd33afc5273e49eb863c4c15f6c4c7d3fbae3eb3c55c
198c5a845975abb97bec91f98df18522db41489cf5b972445600b2c0e3faa828
13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310
2eefb5dc5aae0ca14290ded3490ec8ae44c88fafdac0b062bacd8b9bd1497eb3
32d376bc206926ca6f299e97d04644b68e6a863ac4975bf4a804bd120e82aeab
decfb2acfa48419eb5c32541e8b99aa142ed856a2969012374c2a30f8bd7db70
dd1fa6cb67aa97468e62afeec6bfa9c1cb52f5acf029ab77a0fdd2e34cd50a21
19dba570adb979d9063882d8dd6d880d1f37f25e600cc07097646946ebc947a2
de492c6384df2afd8c36f3f8ca910d93a21a2981b3c3a80e8a858d643122d488
0246d4eb99473ba449b98548167d0767b68b075749a8962d0573851f505689b5
bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a
3e4da5132877e955fb455e58e300b56033c07a6d2709b386fdc5c43a88e1c499
d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e
7c6c180635f5329b270bfa6fd56ec15604cca270687d0a0bc2fc5edd78dc4c9c
90f4e7731fc41021b7ce9f9d15704c9849cf3215161585721a370745f7392e71
61a8d6678098ddfa8d1b418cc5d851823d6b09bd5bb4fcf68f0f0797abe61873
6f00f39f32bb3556f024b6e877337a8e6ba5a2feda5d1187e85684de23471ff7
037165fd0435a477539e437c28f25a2e188d0da72b7573aa7d85b26eb34feef7
dbf293d123fe98900bda70549ce336f08f5ff99372d5f8dca4869376bf068416
d677958e05d8e8a3424225fd62da4a68c9401aa13658ecb9d6dbff18372aca85
2e5f3807db334c44e20f17624cfa529304327387e4795c561374379725acde6c
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152
f9ce9a047b096cb954193ac49049ccb28a476aa8c202f09aea38eae3cb283387
6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4
44337a866f639a40a3730a29a44dfebc9f6828148b409c057969c27987c84dbd
e9d0af516a8d65649c6850b69ff15e65cba280f8d44dbc505882dd16cf922320
f9ebef99fedb86176dafbdecb67a9f600be7f6acb1299deeeb40d4a689018f1c
f901f4b9437419d09352abcdec1a1e7bb1b511adbee059c42695753575b2b77c
91d4c54eb5e24448922894a73d0a3ca2b0a84caa3d2a5526e57098791ad75f73
2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b
7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a
e492ab74db73fb05a78112868596383e27ad49d8a2aa82a34611eea44a23a1ef
9f772e3b6f92a0f25a040c1fc12899847dfce0a8b0a331be87be264b536c446b
e30fa7df6be2d12dd90390ccad92eb721befc297b387cf1f3dca27a9166b13c6
4813a5905b2003965fe10155c8daf3cdbb57017af02483a53a2d5ca11a9270f7
f291625e88495cd7da966f1c724c30b6bab3788c42760d6de3d7fd55274a3b0d
5483462ebe9bc5efca3315a9f2ce6a82f0469980e164aa16afecac9ebf13b57d
ea48def5335b8e664304ae54ff020858a1cb8a804d21f1c474c21e4ef2213073
3e90bab5c79be10c283f3752091122910f7c5b9f35428a37eb0250d244d01f94
5f51bf583798f714b2c84e3b6ba30b32b15a12ac308a52efbc950ae406216ad8
e797bb75f04bcac68e688769585623a306a0442a5614f28cb1a38d4232f525ec
066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40
325be1d623422763b0e16bc3c294cc5c006f6fb2ff8ddbf9eb0e45f8d8ac6853
3790861e8c62040dbb2dd3c290d1a2738cef6b04fd38de2d37ba58708838ddab
2b4e54af556badc27f08c9a966dd55f090f4a5ef8978793e0ba296b05ddfb242
f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880
cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92
eb2ecf9b7aaa6a3d36d66aac6cc107c09c0518a06272f27ae17f2430c1d7a70f
8711c0444e0e2869118f577b3e28776c75d0845691bac42cb92005cc97c62b8a
99257e66c5904573be6b6316fbace99d9cb4ac2806b88c6e1e1c04787a2f4bd3
1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5
4fbea9806312eece3dd8523cf6c9509cedda1abe14fdc55bf793606dffe6c053
044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6
aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857
bd2104c458f1c7197b830efb636df4741232585d55334fcdb6e37e8657571c24
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
c3dc5d9c25e3ef368835ad761bc9b0650170a018d70f93869608105375b73019
b20f2f7de684b2b10149825c4b86e14fadc7e19d5d41cb7b180bee28a1def030
bfb1b045ee5fc2bc3e4ca29683d695c36cc033ed43c0071385907400bc09c7f6
4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277
ce69de794ef8654455e9323c8dd184a507c39bb319b9c1b34fce460deca631bf
e784a1f8667b80617e5e26ab23f4b101286dd5bddb9629ca59d272ee3267e3ca
37aad7dc61ea841a62ed160802b822c35a0110f3e0be393b0c43a7fae8e96c65
1b9e1710ba83325c36ba9496bb3ff924a69326d07f62afec79ef74adbfcf27f2
3e3fc0ee150a9b3e97a1306c1929076d637f3c6ce3dbddcf30570330e40bf609
efed6ec2f8d3190bbf49a8c62a73c80878a4b7968baabfcff38cd0c3b06d4cff
d14140f160c6659a0848ec2b808bd37739af9b8a28d6d8cd7fc607ab845ab026
7f7089400087e55dbe741b1b137a6712f22d80b67c28215000b8f15787322dc2
429aed088fe3b2dc4cf969687d3eb7412bc387a9f6a7c68b832613630e8c527f
93fbcce3b23629eef2b3ed15e67b61cd5ba82f6a4cf4933b05ee3a1cb17b0523
ba63290ef5e3c1d1e2881879708f9fc793792f1f8ad36bcc8d2cdda9dc3e7ec8
7d784959adbb08754d954aee02c959a1a7318c54d04bccee906952cdbf090ea6
89389da3d32117ac9a495120372591cd36bff66f55ffc0e2e53ed8d64458d433
52c5297a7066438d5ec5ce3e897b7fe3eb642dca0b30aba3cc28866cbb05d96d
21ab6c559c1f1c445e9450f180e252e78799374ebd5d3b0e6384afd3eeeee20e
796364acf14011fa3902103655be7328eef8e3c5bd8635cac4820b5757ec9d13
c8f5d3f153fab81b07f3e666e13bcbd01d696a7efa4ae0c8dc81c054443e5b67
a3d362e58a6aa1b9d9d9ff542c65dccef0423e52dc8d11df2a515be8258ff3ac
090d906fa847c480583c96b467272b407e6c820d0d64b454e6e53dd51d113b03
90da1d87ebf79eefc2a035cc6311b9a26ff17804d6561c9f8253f4189d1c1f57
c33a5d3fd76760bd1657a2007d5ae2ba55155c0fd3ef9bb7e771e41c084158e5
237358a60a6aeaf9e2f5247fdf1c2cc04e3e3c0ff57e2c03b799d10b770361f7
cd4b8eb7fa51767c3cc1942e3523e99026062f95dfcb0428033dd7b706db8481
c90e5c5f118bfc7417e1a43d8ec7a1d6e91a730f336a47799b81f16a0fd6d69c
614f6326a378a9c583fc7de320ea6a60a78706283ec087afcb349ca75c083807
f19253d1e2423e2613b27354b1d8670fc63ffbb2d194ebf00e2323f712141648
93ddcee5487885a9825538b723ba30214b827617f85aef5558d232545171e8f6
2921a0fa40963ad342875ba6fc57c1629caa800f834ebf516a6cf6a59f467212
d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b
4822c68976983fb6be04a489ecb0ee85233585040f94599ae1f40e91a815d3d3
12a6b979da40489d768e28882836de2434009bcb436c2901772bed7633d88770
SH256 hash:
cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92
MD5 hash:
06fe875e4701de15eb98fef1e228d32b
SHA1 hash:
cca987129e4a7ce3a9853e419ccdac32130310d3
Link:
https://www.unpac.me/results/2507f992-6086-4701-8086-162bad1f5308/
Malware family:
Warzone
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cc0fdb6946af/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments