✕
Request a Demo
Rewterz
Rewterz Threat Alert – APT29 Cozy Bear – Active IOCs
August 26, 2022
Rewterz
Rewterz Threat Alert – RedLine Stealer – Active IOCs
August 26, 2022

Rewterz Threat Alert – AveMaria RAT – Active IOCs

Severity

Medium

Analysis Summary

AveMaria RAT – aka WarzoneRAT – is a remote access trojan that targets Windows systems that provides the capability to gain unauthorized access to a victim’s PC or allow covert surveillance of it. It acts as a keylogger, can steal passwords, escalate privileges, and much more. AveMaria, like most malware, first arrives at systems as a result of phishing emails (as invoices and shipping orders), but is also available on the dark web for subscriptions. This malware-as-a-service RAT is written in C++ that has been available for purchase since at least 2018.

Impact

  • Unauthorized Access

Indicators of Compromise

MD5

  • b2cd9c71ae265562bda35328670c296a
  • 6033d3fe215e208626904dffbb9f27fc
  • 16a9ddc4b32981114fe4f069a4353105

SHA-256

  • 68191d4ba2ad20bf53986dfc5db193397a6bead2c9342078d9a34475230659ef
  • 06d73b35cc732c48308c14a0f72a430d6837591a49d7781a4d735ef79fe27a41
  • 477cab8d4385172d679200edc6619462de2402d912f21f36981fc058987a6d52

SHA-1

  • 4a625af154bcd6fb3097e20e03ab643d25c483e8
  • 736a139470dd7166af2418b7d11f5dd66e13ce7f
  • bf73849f57c150f9e2199c61427f631be2dfa595

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.