virussign.com_6bd8f4c275631d22d679eb1456db3180.vir
AveMaria RAT with C2 and injection
Raw-IP WinInet memory process loaderDirect-IP URLMon WinInet execute dropper
SHA-25618d786fe8515c0bdd29acb0c21dd8bd0acc08ce819aac2f12d6bc57ac1388780
Evidence
⋯7 more rows
0x3f000000000000000000000000000000000................
0x400558bec837d1000750433c05dc38b4d0cU...}..u.3.]..M.
0x4108b4508ff4d10740a8a103a1175044041.E..M.t...:.u.@A
0x420ebf10fb6000fb6092bc15dc3558bec83........+.].U...
0x4307d10008b4d08568bf174128b550c8a02}...M.V..t..U...
0x440ff4d1088014142837d100075f18bc65e.M...AB.}..u...^
0x4505dc38b4c240c85c974268a442408538a]..L$...t&.D$.S.
0x460d88afb8bd1578b7c240cc1e9028bc3c1.....W.|$.......
0x470e010668bc3f3ab8bca83e103f3aa5f5b..f..........._[
0x4808b442404c38b442404a3a0653bfcc3a1.D$...D$...e;...
0x490a0653bfc69c0fd43030005c39e2600a3.e;.i..C.....&..
0x4a0a0653bfcc1e81025ff7f0000c3ff7424.e;....%......t$
0x4b0046a00ff15c8213bfc50ff15cc213bfc.j....!;.P...!;.
0x4c0c3ff7424046a00ff15c8213bfc50ff15..t$.j....!;.P..
0x4e02b44240448c38b542404568b74240c57+D$.H..T$.V.t$.W
0x4f0eb0684c9740e42468a0e0fb6020fb6f9....t.BF........
0x5002bc774ee85c05f5e7d0483c8ffc37e03+.t..._^}.....~.
0x520414284c075f68b442404c3ccccccccccAB..u..D$.......
0x5303d00100000730ef7d803c483c0048500=....s..........
0x540948b0050c3518d4c240881e900100000...P.Q.L$.......
0x5502d0010000085013d0010000073ec2bc8-......=....s.+.
0x5707d3bfc3b0dc47c3bfc7313a114783bfc};.;..|;.s...x;.
0x580c70488b7123bfc41890d3c7d3bfcc3e8.....;.A..<};...
0x59089e90000b9c2123bfce985460000e853.......;...F...S
0x5a0fe0000b9cc123bfce976460000e8dd9f......;..vF.....
0x5b00000b9d1123bfce967460000e80e7300.....;..gF....s.
0x5c000b9d6123bfce958460000e87bb50000....;..XF...{...
0x5d0b9db123bfce9494600008b0d3c7d3bfc...;..IF....<};.
0x5e03b0dc47c3bfc7313a114783bfcc70488;..|;.s...x;....
0x5f0e0123bfc41890d3c7d3bfcc3e82da300..;.A..<};...-..
0x60000b9fb123bfce91846000051b92c7d3b....;...F..Q.,};
0x610fce8aacb0000b900133bfce903460000.........;...F..
0x6208b0d3c7d3bfc3b0dc47c3bfc7313a114..<};.;..|;.s...
0x630783bfcc704880a133bfc41890d3c7d3bx;......;.A..<};
0x640fcc3c70120243bfc8bc1c20400a1a866.... $;........f
0x6503bfc85c0751c6a1859e84b47000085c0;...u.j.Y.KG....
0x66074098bc8e87f5f0000eb0233c0a3a866t....._....3...f
0x6703bfcc3558bec5356578bf133ff6a0558;..U..SVW..3.j.X
0x46faec223bfc89430c83f8ff74428b46048d.";..C....tB.F..
0x470ab3c80100006a028983cc01000058ff75.....j.......X.u
0x471a0c668906ff15e0223bfcff75fc668983.f.....";..u.f..
0x472aca010000ff15dc223bfc6a1056ff730c.......";.j.V.s.
0x473aff15e8223bfc83f8ff751609430c33ff...";....u..C.3.
0x474a8b4d08e8a90500008bc75f5e5bc9c208.M........_^[...
0x475a00ffb3d8010000897b08ff1560213bfc........{...`!;.
0x476aebde56578bf1e814dcffff33ff897e10..VW.......3..~.
0x477a897e14518d8ed8010000897e30897e34.~.Q.......~0.~4
0x478ae8318a00008d4638506a02ff15f4223b.1....F8Pj....";
0x479afc834e0cff8bc6897e18897e245f5ec3..N.....~..~$_^.
0x47aa558bec5151568bf157837e04008d7e08U..QQV..W.~...~.
0x47ba75298d4e3c8b01ff308d45 u).N<...0.E
0x679f00080000ababab33ff5751e8a39cffff.......3.WQ.....
0x67afa1ac663bfc680802000083c0105750e8..f;.h.......WP.
0x67bf8f9cffffa1ac663bfc83c41883c01050......f;.......P
0x67cf57576a1c57ff1530223bfca1ac663bfcWWj.W..0";...f;.
0x67df8b35e8213bfc83c010682c243bfc50ff.5.!;....h,$;.P.
0x67efd68d45ec50ff15b4203bfc0fb745f850..E.P... ;...E.P
0x67ff0fb745f6500fb745f4500fb745ec500f..E.P..E.P..E.P.
0x680fb745ee500fb745f2508d852cffffff68.E.P..E.P..,...h
0x681f74273bfc50ff15b8223bfc83c4208d85t';.P...";... ..
0x682f2cffffff50a1ac663bfc83c01050ffd6,...P..f;....P..
0x683f8b0dac663bfc8d411083c10c50e874bc...f;..A....P.t.
0x684fffffa1ac663bfc5768800000006a0257....f;.Wh....j.W
0x685f6a016800000010ff700cff15ac203bfcj.h.....p.... ;.
0x686f8b0dac663bfc50894104ff15e4213bfc...f;.P.A....!;.
0x687f575368c0743afc6a0dff1580223bfc8bWSh.t:.j....";..
0x688f356c223bfceb148d45d050ff15b0223b5l";....E.P...";
0x689ffc8d45d050ff1570223bfc5757578d45..E.P..p";.WWW.E
0x68afd050ffd685c07fdf5f5e33c05bc9c204.P......_^3.[...
0x68bf00558becff75108b550c8b4d08e80400.U...u..U..M....
0x68cf00005dc20c00558bec83ec34538bc28b..]...U....4S...
0x68dfd9568945f8895dfc578b7d082d000100.V.E..].W.}.-...
0x68ef00740983e8040f85100400008b3783fe.t...........7..
0x68ff270f82a800000083fe400f87a4000000'........@......
0x690f6a10ff157c223bfc6685 j...|";.f.
⋯7 more rows
0x111042d0000002b0000003d0000000d0a0000-...+...=.......
0x1111453454c454354202a2046524f4d206c6fSELECT * FROM lo
0x1112467696e73000000002e0074006d007000gins......t.m.p.
0x11134000000005c0047006f006f0067006c00....\.G.o.o.g.l.
0x1114465005c004300680072006f006d006500e.\.C.h.r.o.m.e.
0x111545c005500730065007200200044006100\.U.s.e.r. .D.a.
0x11164740061005c0044006500660061007500t.a.\.D.e.f.a.u.
⋯8 more rows
0x111f473005c00000000005000610074006800s.\.....P.a.t.h.
0x112040000000068007400740070003a002f00....h.t.t.p.:./.
0x112142f007700770077002e0067006f006f00/.w.w.w...g.o.o.
0x1122467006c0065002e0063006f006d000000g.l.e...c.o.m...
0x112340000000068007400740070003a002f00....h.t.t.p.:./.
0x112442f0035002e003200300036002e003200/.5...2.0.6...2.
0x11254320035002e003100300034002f0064002.5...1.0.4./.d.
0x112646c006c002f0073006f00660074006f00l.l./.s.o.f.t.o.
0x112746b006e0033002e0064006c006c000000k.n.3...d.l.l...
0x112840000000068007400740070003a002f00....h.t.t.p.:./.
0x112942f0035002e003200300036002e003200/.5...2.0.6...2.
0x112a4320035002e003100300034002f0064002.5...1.0.4./.d.
0x112b46c006c002f006d007300760063007000l.l./.m.s.v.c.p.
0x112c43100340030002e0064006c006c0000001.4.0...d.l.l...
0x112d40000000068007400740070003a002f00....h.t.t.p.:./.
0x112e42f0035002e003200300036002e003200/.5...2.0.6...2.
0x112f4320035002e003100300034002f0064002.5...1.0.4./.d.
0x113046c006c002f006d006f007a0067006c00l.l./.m.o.z.g.l.
0x11314750065002e0064006c006c0000000000u.e...d.l.l.....
0x113240000000068007400740070003a002f00....h.t.t.p.:./.
0x113342f0035002e003200300036002e003200/.5...2.0.6...2.
0x11344320035002e003100300034002f0064002.5...1.0.4./.d.
0x113546c006c002f0076006300720075006e00l.l./.v.c.r.u.n.
0x11364740069006d0065003100340030002e00t.i.m.e.1.4.0...
0x1137464006c006c0000000000000068007400d.l.l.......h.t.
0x11384740070003a002f002f0035002e003200t.p.:././.5...2.
⋯7 more rows
0x11cf453746f7261676500222c00002a000000Storage.",..*...
0x11d044163636f756e74735c4163636f756e74Accounts\Account
0x11d142e72656330000000736f667477617265.rec0...software
0x11d245c4165726f666f785c466f786d61696c\Aerofox\Foxmail
⋯9 more rows
0x11dc46400700077007200610070002e006900d.p.w.r.a.p...i.
0x11dd46e006900000000005c00730071006c00n.i.....\.s.q.l.
0x11de46d00610070002e0064006c006c000000m.a.p...d.l.l...
0x11df472007500640070000000000072007000r.u.d.p.....r.p.
0x11e04640070000000000000000000534f4654d.p.........SOFT
0x11e14574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x11e24696e646f7773204e545c43757272656eindows NT\Curren
0x11e347456657273696f6e5c57696e6c6f676ftVersion\Winlogo
0x11e446e5c5370656369616c4163636f756e74n\SpecialAccount
0x11e54735c557365724c697374000053006500s\UserList..S.e.
0x11e6444006500620075006700500072006900D.e.b.u.g.P.r.i.
0x11e74760069006c0065006700650000000000v.i.l.e.g.e.....
0x11e8400000000530059005300540045004d00....S.Y.S.T.E.M.
0x11e945c00430075007200720065006e007400\.C.u.r.r.e.n.t.
0x11ea443006f006e00740072006f006c005300C.o.n.t.r.o.l.S.
0x11eb4650074005c0053006500720076006900e.t.\.S.e.r.v.i.
0x11ec46300650073005c005400650072006d00c.e.s.\.T.e.r.m.
0x11ed453006500720076006900630065005c00S.e.r.v.i.c.e.\.
0x11ee450006100720061006d00650074006500P.a.r.a.m.e.t.e.
0x11ef472007300000000005300650072007600r.s.....S.e.r.v.
0x11f0469006300650044006c006c0000000000i.c.e.D.l.l.....
0x11f1400000000530059005300540045004d00....S.Y.S.T.E.M.
0x11f245c00430075007200720065006e007400\.C.u.r.r.e.n.t.
0x11f3443006f006e00740072006f006c005300C.o.n.t.r.o.l.S.
0x11f44650074005c0053006500720076006900e.t.\.S.e.r.v.i.
0x11f546300650073005c005400650072006d00c.e.s.\.T.e.r.m.
0x11f6453006500720076006900630065000000S.e.r.v.i.c.e...
0x11f7449006d00610067006500500061007400I.m.a.g.e.P.a.t.