MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1d165776063f60a18cdd5d21f19c4700f79b1911da4d78c42fd2c885feac0b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1d165776063f60a18cdd5d21f19c4700f79b1911da4d78c42fd2c885feac0b9
SHA3-384 hash: ea1a4df01d40f96eff30c152ba0367764ce9341349eaee11ce9e7918bd50c20b16afcef4142640b4510a0f50dbb98717
SHA1 hash: 48288eb3e65f0ca9e251cba3dc1fe1c1912b96ac
MD5 hash: 34af131a5f97d362fd61d20963e0831b
humanhash: texas-hydrogen-purple-sweet
File name:34af131a5f97d362fd61d20963e0831b.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:1'947'136 bytes
First seen:2020-05-25 11:50:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e65c5a414877e3a8b8302172f88b67a3 (4 x AveMariaRAT, 1 x 404Keylogger)
ssdeep 3072:0oQ03b5U5A71T6i3VYKRFaWvRv+Wiguf/ZgaYDv/eAg0FujrVfsYdKAHq:0oQ0Lm5Y1bjFaWpv+Wi9MvWAO9swK2q
Threatray 8'493 similar samples on MalwareBazaar
TLSH 63955C1339C1ED5EC1FA00B0C9B3DFA3395AFE615E104136C3DB3B5A4D45698A62CAE6
Reporter abuse_ch
Tags:AgentTesla AveMariaRAT exe


Avatar
abuse_ch
AveMariaRAT C2:
qlox.duckdns.org:1738 (209.58.144.239)

AgentTesla SMTP exfil server:
mail.kteadubai.com:587

AgentTesla payload URL:
http://clubcaddy.com/kest/look.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47900.12160.3027.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fsysna
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 19:43:31 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
1b13660c52adcccc1cef45f137a3373f5615500a609c61a9872e5ed4336e629a
AveMariaRAT
2534d4d9d35acd53aacf73d734a158e8cfd12c9e6a3d3527f2fb1e2dbf5a487d
AveMariaRAT
3a5943219f8400531a411b909b666337ba4f232d19e003a0128e0d699106f04f
AveMariaRAT
40503a4df817599fdf0125c5b99076700718e3eb50bbb759d139aa95a8d18d59
AveMariaRAT
4b13bb36220d46ab9fa89c4163c8ec571fe0c113af00773d0968fa51c4056bbd
AveMariaRAT
b5b64f85cdeb5432018e22087fce4b6dc1e56593e8416335f471d4eac1e2b8cf
AveMariaRAT
c2f08787396a9dd02b4294818f0919695771ad8689b40b050fe65ebef18aa5ca
AveMariaRAT
c72cde3224e01da2283065c5a94d252f528c132019eb2f2656c86a7caa1006c2
AveMariaRAT
d7a9047d6d19050866c5b5c7d08f4b45208d9b2a2a4f4179cadaf37ea92cfa89
AveMariaRAT
f58206c0e3f90670105f3d92f49e4f3e4dd36970697f24de762862f24ea130cf
AveMariaRAT
+ 8'483 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer rat
Link:
https://tria.ge/reports/201109-pxtqz11vxs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Warzone RAT Payload
WarzoneRat, AveMaria
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_malumpos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AveMariaRAT

Executable exe e1d165776063f60a18cdd5d21f19c4700f79b1911da4d78c42fd2c885feac0b9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367836/
  
URLhaus
https://urlhaus.abuse.ch/url/367835/
  
Delivery method
Distributed via web download

Comments