Loading... Additional Content is being loaded
Windows
Analysis Report
ORDER893474849.exe
Overview
General Information
| Sample name: | ORDER893474849.exe |
| Analysis ID: | 1445941 |
| MD5: | 6ff047f1181667ebef43b9fe8805f56a |
| SHA1: | bfccf361769e5d0eae62c6b70d289692c0b849e7 |
| SHA256: | 68b2d98b149d4eb8bee52f7dad010fca5850a21c8e872783b18f2c414dc29320 |
| Tags: | exe |
| Infos: |   |
 |
|
Detection
AveMaria, GuLoader, PrivateLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Yara detected AveMaria stealer
Yara detected GuLoader
Yara detected PrivateLoader
AI detected suspicious sample
Contains functionality to hide user accounts
Found suspicious powershell code related to unpacking or dynamic code loading
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Obfuscated command line found
Powershell creates an autostart link
Powershell drops PE file
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Potential Dosfuscation Activity
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara detected Credential Stealer
Yara signature match
Classification
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Ave Maria, AveMariaRAT, avemaria | Information stealer which uses AutoIT for wrapping. |
|
|
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
|
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| PrivateLoader | According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server. | No Attribution |
|
AV Detection |
  |
|---|
| Source: |
URL Reputation: |
||
| Source: |
File source: |
||
| Source: |
Integrated Neural Analysis Model: |
||
| Source: |
Static PE information: |
||
| Source: |
Directory created: |
Jump to behavior | ||
| Source: |
Static PE information: |
||
| Source: |
Binary string: | ||