MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da8e89fa0cbec2f66ea695865de7a0eb7f9211c10aae3598490bbaec4f83ebfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da8e89fa0cbec2f66ea695865de7a0eb7f9211c10aae3598490bbaec4f83ebfc
SHA3-384 hash: ff386c72c1c2b327a109759b511c36edd6067790992e57bd63e9c1ce279972771f57676ab7a7895bd8f22277f412a7c7
SHA1 hash: 2e6901c0e9182e946a2499d0dce8d98a8837b011
MD5 hash: aade658ec7f1e9aa00f25975c65f361c
humanhash: october-colorado-don-south
File name:DHL DOC No_SINI0068206497_PDF.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:2'092'032 bytes
First seen:2020-06-25 13:39:02 UTC
Last seen:2020-06-25 14:52:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f08bf0e9242145dda7807c9aa809522 (2 x AveMariaRAT)
ssdeep 12288:q9q7b6iisuutUJNRCKrzKa/6D+MUVGAarBY4OuAAUzZPp2DhaBRGwLZYr:pbkRCKHkDnAFi
Threatray 511 similar samples on MalwareBazaar
TLSH 49A54C0237809C29F5FB11F089BB96A6293EFAD11F1080E793C53ADD4D15AE4BD34B5A
Reporter James_inthe_box
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
WarzoneRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/14358/
Detection(s):
SecuriteInfo.com.BScope.Trojan.Sonbokli.28428.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Launching a process
Creating a process with a hidden window
Creating a process from a recently created file
Launching cmd.exe command interpreter
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Unauthorized injection to a system process
Detection:
avemaria
Create hunting rule
Link:
https://mwdb.cert.pl/sample/da8e89fa0cbec2f66ea695865de7a0eb7f9211c10aae3598490bbaec4f83ebfc/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 10:13:13 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3khit6qmx3bpm3vgswdf3z5a5n7zeeobbkxdlgcjbo5oyt4d5p6a._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
09fe435d0a761f4ebf0a28d7c023bb5448f5b924f3296f5054392996a521fc11
AveMariaRAT
25db81a9c27d2c56fb1d168f3416260ae33470a32e8adb3ff15a0b30e43abc6d
AveMariaRAT
5c7b6c75eee95614a740b733b6895346066ae6c893c7b7cc8885ffa425ca6c86
AveMariaRAT
a102c4a2dfca8c218f1e65cbb5050012da856c3deba018d8c238fa9b09dd3a2b
AveMariaRAT
aa78a6486a07e5063b9d8510f1b483195d0de3affe4de0b87e0b75b615c25e72
AveMariaRAT
d0c16d7dd39f3e0c3972b5c19de8e9daeb031d3ce55a6329a0ce76271904d078
AveMariaRAT
d5244d189112fede20a99ed1f7ca814762f9ab52cedaca1c1770c47ed69a6498
AveMariaRAT
ebddbf171d569ce4db44a0284ac1cbe390e075854749713aa9186276036cacd6
AveMariaRAT
f6992d6684eb90b504ae13c3a5159e336005a415c7e50ed2dc7f1420ffa488b1
AveMariaRAT
f99107fb49e1a9ae31d72e1a052baa79ce419ce970bc521010885c98a3d6e6ac
AveMariaRAT
+ 501 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200625-tz17g61zde/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_ave_maria_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/14358/

Comments