2021-10-11 AveMaria IOCs

THREAT IDENTIFICATION:  AVEMARIA STEALER / WARZONE RAT

SUBJECTS OBSERVED
FW: RFQ

SENDERS OBSERVED
m.asyraf@synergymarine.com.my

EMAIL BODY
Forward

Regarding the subject above, we are requesting quotation.

Attached herewith GA for your reference.

Thank You & Best Regards

Muhamad Asyraf

Procurement Executive

MALDOC FILE HASHES
RFQ.zip
7b08155395fb5f5e3475e0b928b1d164

AVE MARIA PAYLOAD FILE HASHES
RFQ.exe
d0ab8f6880aa6bfd89e2425967f36090

Renamed to:
cLUPBlnVzsFFjJ.exe
d0ab8f6880aa6bfd89e2425967f36090

AVE MARIA C2
31.210.20.231:1004

SUPPORTING EVIDENCE
Strings in memory
Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper
warzoneTURBO