MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5aa4fe1049ed94dbf22ad1427013a30762ebd9ac2a89726f9f313b087e2a4a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AveMariaRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5aa4fe1049ed94dbf22ad1427013a30762ebd9ac2a89726f9f313b087e2a4a0
SHA3-384 hash: 2cf83a4b253de16bf9696f58144aa1004b45143604262ed9874e8880f166aae5d677fab50163cebb056c740b8695bc51
SHA1 hash: ee76c88679882ab6739c9c140d88795bb62bab15
MD5 hash: 7fd18a9ba85fc28bb80251e75ec96456
humanhash: zulu-arizona-one-six
File name:7fd18a9ba85fc28bb80251e75ec96456.exe
Download: download sample
Signature AveMariaRAT
Create hunting rule
File size:671'744 bytes
First seen:2021-02-06 08:21:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:7YtzVMgeEUb7lQLvvfqao9DlzlPtSTtpxCqme8bC:7UM2Ub7avnulXIpxCq9uC
Threatray 15 similar samples on MalwareBazaar
TLSH 6FE49D36F7619B81C038BB3B4662795C63F1F0E71331E9AB2F850AF509975908FAE149
Reporter abuse_ch
Tags:AveMariaRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5099834809.xlsx
Verdict:
Malicious activity
Analysis date:
2021-02-06 08:19:30 UTC
Tags:
encrypted exploit CVE-2017-11882 loader trojan stealer rat avemaria
Link:
https://app.any.run/tasks/80582f44-e4e8-4503-bc1f-cece1e48af1a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/115916/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45687695.29097.15191.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Running batch commands
Launching a process
Sending a UDP request
Creating a process from a recently created file
Creating a file
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/601036
Signature
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates an undocumented autostart registry key
Drops PE files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Yara detected AntiVM_3
Yara detected AveMaria stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 349537 Sample: cxZ1hwj54g.exe Startdate: 06/02/2021 Architecture: WINDOWS Score: 100 57 Multi AV Scanner detection for domain / URL 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 9 other signatures 2->63 8 cxZ1hwj54g.exe 15 7 2->8         started        process3 file4 47 C:\Users\user\AppData\...\notepaaaaddsss.exe, PE32 8->47 dropped 49 C:\...\notepaaaaddsss.exe:Zone.Identifier, ASCII 8->49 dropped 51 C:\Users\user\AppData\...\cxZ1hwj54g.exe.log, ASCII 8->51 dropped 73 Drops PE files to the startup folder 8->73 75 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->75 12 notepaaaaddsss.exe 14 5 8->12         started        16 cmd.exe 1 8->16         started        signatures5 process6 file7 53 C:\Users\user\AppData\...\notepaaaaddsss.exe, PE32 12->53 dropped 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->77 79 Injects a PE file into a foreign processes 12->79 18 notepaaaaddsss.exe 3 4 12->18         started        22 notepaaaaddsss.exe 2 12->22         started        25 notepaaaaddsss.exe 12->25         started        31 13 other processes 12->31 27 reg.exe 1 1 16->27         started        29 conhost.exe 16->29         started        signatures8 process9 dnsIp10 55 warzone109983runnerhacker.duckdns.org 194.5.98.5, 49738, 9040 DANILENKODE Netherlands 18->55 65 Increases the number of concurrent connection per server for Internet Explorer 18->65 67 Installs a global keyboard hook 18->67 45 C:\Users\user\...\notepaaaaddsss.exe.log, ASCII 22->45 dropped 69 Multi AV Scanner detection for dropped file 22->69 33 notepaaaaddsss.exe 22->33         started        35 notepaaaaddsss.exe 25->35         started        71 Creates an undocumented autostart registry key 27->71 37 notepaaaaddsss.exe 31->37         started        39 notepaaaaddsss.exe 31->39         started        41 notepaaaaddsss.exe 31->41         started        43 9 other processes 31->43 file11 signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5aa4fe1049ed94dbf22ad1427013a30762ebd9ac2a89726f9f313b087e2a4a0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-06 08:22:10 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
1cf9635133972859e226ccff6a787c9bb8d2ca6471ae5a9650b3841625072444
AveMariaRAT
3e0a33b7557b15e2f31da51b104afbc14d06b2dd6374ff4d26d357a2f14da76d
AveMariaRAT
49a63eb1c6fd5d4b22396bb8a8397c3bf124c3f94d104bc2a7a304f4457b4526
AveMariaRAT
581d4ba63e52707e1839c7d2c026c847d788b8b3025046bdb491f95a431ca1f7
AveMariaRAT
5da82dd52f913ff5d416ec5479133a0f89cd5d835d2fbd964f32191f642ca9fa
AveMariaRAT
a8e43601776f927b6f02d5c473ae0caa3f686b948236c94a377b68fc9aaff830
AveMariaRAT
bbd91445baa27c316821c545a5aef3079d7bed7beac77de667f88d1617439215
AveMariaRAT
d09722da6fd4b8eb8ba3ee4d8e8a7ffe2cd396c410fa074bcb9fd0b44e399cb9
AveMariaRAT
d7b0f275997cb07e5a97600fb21eb19d14096352af7990797f863b74941a1603
AveMariaRAT
f2a9b8210e9545bf90468330a3afe70cbe26148b94658c49ff77cd59c733117b
AveMariaRAT
+ 5 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:warzonerat infostealer persistence ransomware rat
Link:
https://tria.ge/reports/210206-lp6yp11na6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Executes dropped EXE
Warzone RAT Payload
Modifies WinLogon for persistence
WarzoneRat, AveMaria
Unpacked files
SH256 hash:
f5aa4fe1049ed94dbf22ad1427013a30762ebd9ac2a89726f9f313b087e2a4a0
MD5 hash:
7fd18a9ba85fc28bb80251e75ec96456
SHA1 hash:
ee76c88679882ab6739c9c140d88795bb62bab15
Link:
https://www.unpac.me/results/656582b3-d7da-47ef-bde8-474a0e3c23ec/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/f5aa4fe1049ed94dbf22ad1427013a30762ebd9ac2a89726f9f313b087e2a4a0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AveMariaRAT

Executable exe f5aa4fe1049ed94dbf22ad1427013a30762ebd9ac2a89726f9f313b087e2a4a0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/990168/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/115916/

Comments