Ave Maria / Warzone RAT
date: 4/27/2021
delivery: email [Subject: Requirement, Attachment: Zip (Requirement.7z) w/ EXE (Sales Order.xlss.exe)
persistence: scheduled task "Updates\xSaltlJa" out of c:\users\<userid>\Roaming\xSZaltlJa.exe
capabilities (per memory strings): N/A
c2s: 104.209.133.4:7500
identification method: in-memory strings say "Ave_Maria"
special notes: in-memory references to security researcher "Vitali Kremez"
samples:
7z - https://www.virustotal.com/gui/file/86b17ec2dd6ff42243356c4bf06e7b20fb044bba13d74c342c3df706e98484bd/detection
unpacked exe - https://www.virustotal.com/gui/file/e85769eee5f2539084a2da5bf79027849249130be251d1f2e8b3de0021d194ab/detection
links: https://twitter.com/neonprimetime/status/1387139547025260547
screenshots:
---------------------------------------------------
date: 4/13/2021
delivery: email [Subject: Wholesale Price List, Attachment: XLSB (1-Copy of Quote Industro Sheet 20210413.xlsb, "Digicert logo themed", downloads maskcovld[.]ga/token/rfq/DrawingKit.exe )
persistence: unknown
capabilities (per memory strings): unknown
c2s: crf.eur-import[.]com:6021
identification method: twitter replies
special notes: none
samples:
File - https://app.any.run/tasks/0cf85641-e5be-4979-9e97-8afc0f30fa67/
Payload - https://tria.ge/210413-mp9t774whx
links: https://twitter.com/neonprimetime/status/1381955462967476228
screenshots:
---------------------------------------------------
Are you in need of finance? we give out guarantee cash at 3% interest rate. Contact us on any kind of finance now: financialserviceoffer876@gmail.com whatsapp Number +918929509036 Dr James Eric Finance Pvt Ltd
ReplyDeleteI was thrown out of my own house was sleeping in a hotel for weeks she also took possession of my son could only see him once a week then I found out she was in love with my accountant all these while so I went online and I came across a Russian private investigator who help me get all my properties and my accounts back even my company back how he did these I don’t know but I gave all the information he asked for and followed all his instructions and now I’m happy my life’s better now.
ReplyDeleteThanks to HACKINTECHNOLOGY@CYBERSERVICES.COM
I just said I should share my own story here
Thank you
I know of a group of private investigators who can help you with they are also hackers but prefer to be called private investigators They can help with your bitcoin issues and your clients will be happy doing business with you,they can also help yo with your bad credit score,hacking into phones,binary recovery,wiping criminal records,increase school score, stolen files in your office or school,blank atm etc. Just name it and you will live a better life
ReplyDeleteContact +1(407) 777-4240
Premiumhackservices@gmail.com
He is the best out there,I tested him and he delivered a good job,he helped me settle bank loans,he also helped my son upgrade his scores at high school final year which made him graduate successfully and he gave my son free scholarship into the college,all I had to do was to settle the bills for the tools on the job,I used $500 to get a job of $50000 done all thanks to Robertson he saved me from all my troubles,sharing this is how I can show gratitude in return for all he has done for me and my family
ReplyDeleteContact premiumhackservices@gmail.com
Text/call +1 (984) 733‑3673
WhatsApp +1 (984) 733‑3673
Telegram +1 (984) 733‑3673