December 3, 2023
Severity High Analysis Summary A new and sophisticated Android malware, named FjordPhantom, has been disclosed by cybersecurity researchers. The malware targets users in Southeast Asian countries, […]
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
August 30, 2022Rewterz Threat Alert – LokiBot Malware – Active IOCs
August 30, 2022Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
August 30, 2022Rewterz Threat Alert – LokiBot Malware – Active IOCs
August 30, 2022
Severity
Medium
Analysis Summary
AveMaria RAT – aka WarzoneRAT – is a remote access trojan that targets Windows systems that provides the capability to gain unauthorized access to a victim’s PC or allow covert surveillance of it. It acts as a keylogger, can steal passwords, escalate privileges, and much more. AveMaria, like most malware, first arrives at systems as a result of phishing emails (as invoices and shipping orders), but is also available on the dark web for subscriptions. This malware-as-a-service RAT is written in C++ that has been available for purchase since at least 2018.
Impact
- Unauthorized Access
Indicators of Compromise
MD5
- 5df3af8a3c32eea44615ccd830e740f2
- 5c44699ea6278818cfebf6812887142f
- a633353fde13ce84622515ab315ffc14
SHA-256
- 0f05dc006ea6293412d2d18930b1c2aae9cc5099edd93620501c92059c77f243
- 172297a2448f315029be5d2d4a23bb2ccb39ccede97a88529d4b3cb9fda1e38b
- 4db351188a3fd12e54ef4791c92d1128e3b006feed216ef24e2f6e91de208e95
SHA-1
- 82e8f06c22f68b78e350703ef0f52e73bee35c08
- e9e45d46d2de016222f1f0a8e4a11db8c6f68481
- a379fde869ad9739ff17842a890ec5c3f76cd292
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.