Severity

Medium

Analysis Summary

AveMaria RAT – aka WarzoneRAT – is a remote access trojan that targets Windows systems that provides the capability to gain unauthorized access to a victim’s PC or allow covert surveillance of it. It acts as a keylogger, can steal passwords, escalate privileges, and much more. AveMaria, like most malware, first arrives at systems as a result of phishing emails (as invoices and shipping orders), but is also available on the dark web for subscriptions. This malware-as-a-service RAT is written in C++ that has been available for purchase since at least 2018.

Impact

• Unauthorized Access

Indicators of Compromise

MD5

• 3150914d37182afc3c75125554bf9460

SHA-256

• b9d52cdf2d446fcd7c1eb360935225fe9b3b673ad67edc9f7cddcbaf4c6d23d0

SHA-1

• 66720e49817d123f20bed5d76e018fb07ef4a61b

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.