MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f13b318caba7938d24d18b32e16a1f111ec694b313590a4023f5e277d70ef7db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f13b318caba7938d24d18b32e16a1f111ec694b313590a4023f5e277d70ef7db
SHA3-384 hash: 521901c33e52a7264d7cc1132fb465f44f68d694fd82daa5bbf53feb77ba3aff3469a9bddf09e3203d57871e8c2a576a
SHA1 hash: b88818873dc71b34bff0c6f050e2a416120d914f
MD5 hash: d10f91d211cc7071e094e88adb30b0dd
humanhash: ink-sixteen-zulu-queen
File name:SOLICITUD DE COTIZACIÓN 06-02-23·pdf.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:565'272 bytes
First seen:2023-02-13 07:07:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (386 x GuLoader, 59 x RemcosRAT, 43 x VIPKeylogger)
ssdeep 12288:ukywCpSIj/hl/3fHEs8+N8v2ocCSivrlicgmgOFs:GhSYz/3c48vcKGmgOC
TLSH T1CDC4231513A0E593D7A253312D7CA2B7AB775E2360900A3F6712BF497872389CD2F726
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 8ee2f0b8cc3b3b80 (5 x AveMariaRAT, 1 x GuLoader)
Reporter adrian__luca
Tags:AveMariaRAT exe signed

Code Signing Certificate

Organisation:Prolongation
Issuer:Prolongation
Algorithm:sha256WithRSAEncryption
Valid from:2022-07-08T07:52:39Z
Valid to:2025-07-07T07:52:39Z
Serial number: -03845e24a8a6d2ee
Thumbprint Algorithm:SHA256
Thumbprint: 6fbeafe892cdc9dc3ded5ecdff898a9074214efb83e4705f6cd64cd1b18265a3
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOLICITUD DE COTIZACIÓN 06-02-23·pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-02-13 07:20:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/555c2ab5-d0a8-4b4f-894a-453f6b2b215e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/364839/
Detection(s):
SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.s.27703.19664.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/68903/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63e9e1ee19bdad8346355e08/reports/d2e5712c-fb63-416a-ab50-05ab6a37e564/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f13b318caba7938d24d18b32e16a1f111ec694b313590a4023f5e277d70ef7db
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2a1b76f2-ad21-43ba-8ef3-9d43cbfade87
Result
Threat name:
AveMaria, GuLoader, UACMe
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1173077
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Creates files in alternative data streams (ADS)
Drops PE files to the document folder of the user
Drops script or batch files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Tries to detect Any.run
Yara detected AveMaria stealer
Yara detected GuLoader
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 805870 Sample: SOLICITUD DE COTIZACI#U00d3... Startdate: 13/02/2023 Architecture: WINDOWS Score: 100 71 googlehosted.l.googleusercontent.com 2->71 73 drive.google.com 2->73 75 doc-0c-8g-docs.googleusercontent.com 2->75 83 Malicious sample detected (through community Yara rule) 2->83 85 Multi AV Scanner detection for dropped file 2->85 87 Multi AV Scanner detection for submitted file 2->87 89 9 other signatures 2->89 12 SOLICITUD DE COTIZACI#U00d3N 06-02-23#U00b7pdf.exe 30 2->12         started        16 Windows.exe 19 2->16         started        signatures3 process4 file5 63 C:\Users\user\AppData\...\CCUpdate.exe, PE32 12->63 dropped 65 C:\Users\user\AppData\Local\...\System.dll, PE32 12->65 dropped 101 Tries to detect Any.run 12->101 18 SOLICITUD DE COTIZACI#U00d3N 06-02-23#U00b7pdf.exe 5 14 12->18         started        67 C:\Users\user\AppData\Local\...\System.dll, PE32 16->67 dropped 23 Windows.exe 2 8 16->23         started        signatures6 process7 dnsIp8 77 drive.google.com 142.250.185.142, 443, 49799, 49812 GOOGLEUS United States 18->77 79 googlehosted.l.googleusercontent.com 142.250.186.129, 443, 49800, 49813 GOOGLEUS United States 18->79 53 C:\Users\user\Documents\Windows.exe, PE32 18->53 dropped 55 C:\Users\user\...\Documents:ApplicationData, PE32 18->55 dropped 57 C:\Users\user\...\Windows.exe:Zone.Identifier, ASCII 18->57 dropped 59 2 other malicious files 18->59 dropped 91 Creates files in alternative data streams (ADS) 18->91 93 Adds a directory exclusion to Windows Defender 18->93 95 Tries to detect Any.run 18->95 97 2 other signatures 18->97 25 Windows.exe 19 18->25         started        29 powershell.exe 23 18->29         started        31 cmd.exe 23->31         started        file9 signatures10 process11 file12 61 C:\Users\user\AppData\Local\...\System.dll, PE32 25->61 dropped 99 Multi AV Scanner detection for dropped file 25->99 33 WerFault.exe 21 16 25->33         started        35 conhost.exe 29->35         started        37 sdclt.exe 31->37         started        39 conhost.exe 31->39         started        41 sdclt.exe 31->41         started        43 sdclt.exe 31->43         started        signatures13 process14 process15 45 control.exe 37->45         started        process16 47 Windows.exe 45->47         started        file17 69 C:\Users\user\AppData\Local\...\System.dll, PE32 47->69 dropped 81 Tries to detect Any.run 47->81 51 Windows.exe 47->51         started        signatures18 process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f13b318caba7938d24d18b32e16a1f111ec694b313590a4023f5e277d70ef7db/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-02-06 18:48:49 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
19 of 39 (48.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6e5tddflu6jy2jgrrmzoc2q7cepmnfftcnmquqbd6xrhpvyo67nq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:warzonerat downloader infostealer persistence rat
Link:
https://tria.ge/reports/230213-hx9bwsba2x/
Behaviour
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Drops startup file
Executes dropped EXE
Loads dropped DLL
Guloader,Cloudeye
WarzoneRat, AveMaria
Unpacked files
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/0d5e5051-a58c-4faa-b2e3-4a59bcb54f74/
SH256 hash:
194f9df745d5146d334b0e7c8e4afef13cff0f02da3f68bcee8845d26bedb037
MD5 hash:
fd4bc4a2c95d26f61ecb26672415221f
SHA1 hash:
ef1f60af264a21b191beaf2c5ca0204630f1dd1c
Link:
https://www.unpac.me/results/0d5e5051-a58c-4faa-b2e3-4a59bcb54f74/
SH256 hash:
f13b318caba7938d24d18b32e16a1f111ec694b313590a4023f5e277d70ef7db
MD5 hash:
d10f91d211cc7071e094e88adb30b0dd
SHA1 hash:
b88818873dc71b34bff0c6f050e2a416120d914f
Link:
https://www.unpac.me/results/0d5e5051-a58c-4faa-b2e3-4a59bcb54f74/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.02
Link:
https://yomi.yoroi.company/submissions/f13b318caba7938d24d18b32e16a1f111ec694b313590a4023f5e277d70ef7db

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

Executable exe f13b318caba7938d24d18b32e16a1f111ec694b313590a4023f5e277d70ef7db

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/364839/

Comments