MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9f7f56bc3de6401e73e911d5762780f50dc5b8739850a8cb43f980f87f14473. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AveMariaRAT

Vendor detections: 7

Intelligence 7 IOCs 1 YARA 10 File information Comments

SHA256 hash:	e9f7f56bc3de6401e73e911d5762780f50dc5b8739850a8cb43f980f87f14473
SHA3-384 hash:	2afcb7de8aecfb98f0885d155c035daea463a5220cb4ac936b4241620f2a9e6383924cbbdc4a0f40991e25881ba18f0e
SHA1 hash:	c895d5ba185a7da9d6795b587839bbc9c81a0921
MD5 hash:	1fc4fab06c72d3ed4032a7fef16e083a
humanhash:	wisconsin-blossom-jig-high
File name:	SWIFT.7z
Download:	download sample
Signature	AveMariaRAT Create hunting rule
File size:	317'288 bytes
First seen:	2023-04-12 05:39:31 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	6144:3liN13uhYgjYU87XiTTdEyoUlmLpvj2AfLgaIqeZFSQ/KgqJIZa1+ONe7Bj:3UN13ujjYXCTyP7Lpb2q0Uyv/Lqea/eJ
TLSH	T18C6423231E47DEDDA0402739183457377B7D3D8AA2E15E1EC2D78CECE2501A6BD2A0B6
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Reporter	cocaman
Tags:	7z AveMariaRAT payment SWIFT

cocaman

Malicious email (T1566.001)
From: "FK Corporation (THAILAND) Co.,Ltd.<admin@fkcorpo.com>" (likely spoofed)
Received: "from fkcorpo.com (unknown [80.85.154.204]) "
Date: "11 Apr 2023 06:35:48 -0700"
Subject: "TT PAYMENT PURCHASE COMFIRMATION - NTUC (PI 01"
Attachment: "SWIFT.7z"

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
212.193.30.230:3443	https://threatfox.abuse.ch/ioc/1101822/

Intelligence

File Origin

# of uploads :

# of downloads :

120

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SWIFT.exe
File size:	867'552 bytes
SHA256 hash:	a2231cdfce2e5ec3adcdb8535b1663da96d390e65c0f0c83c385a96d97790f0e
MD5 hash:	24b58901a371adc86a36b7cc1189f2f6
MIME type:	application/x-dosexec
Signature	AveMariaRAT

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Bulz.89663.25508.19538.UNOFFICIAL

SecuriteInfo.com.Variant.Bulz.89663.251.20581.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/e9f7f56bc3de6401e73e911d5762780f50dc5b8739850a8cb43f980f87f14473/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint formbook keylogger modiloader overlay packed remcos stealer zusy

Link:

https://www.filescan.io/uploads/64364433c41e8bc6a3b10d9e/reports/96ac6ed4-4daf-4aa1-995f-b724907589fc/overview

Verdict:

Malicious

Labled as:

Mal/Drod7zip

Link:

https://www.hybrid-analysis.com/sample/e9f7f56bc3de6401e73e911d5762780f50dc5b8739850a8cb43f980f87f14473

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e9f7f56bc3de6401e73e911d5762780f50dc5b8739850a8cb43f980f87f14473/

Threat name:

Win32.Trojan.Bulz

Status:

Malicious

First seen:

2023-04-11 07:06:58 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5h37k26d3zsadzz6seovoytyb5inyw4hhgcqvdfuh6ma7b7rirzq._file

Result

Malware family:

warzonerat

Score:

10/10

Tags:

family:modiloader family:warzonerat collection infostealer persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/230412-gm2cvsbh5x/

Behaviour

Enumerates system info in registry

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

ModiLoader Second Stage

Warzone RAT payload

ModiLoader, DBatLoader

WarzoneRat, AveMaria

Malware Config

C2 Extraction:

nightmare4666.ddns.net:3443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e9f7f56bc3de6401e73e911d5762780f50dc5b8739850a8cb43f980f87f14473

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Sectigo_Code_Signed Create hunting rule
Description:	Detects code signed by the Sectigo RSA Code Signing CA
Reference:	https://bazaar.abuse.ch/export/csv/cscb/

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research