2021-08-09 Aggah IOCs

THREAT IDENTIFICATION:  AGGAH / AVEMARIA RAT / WARZONE STEALER

SUBJECTS OBSERVED
FW: Re: Invoice for July 2021 and Stateement od Account.pdf

SENDERS OBSERVED
[email protected]

MALDOC FILE HASHES
14 Invoice & Statement of Account for JULY 2021,pdf.ppam.zip
60fe5c88b6442a4e6b536ab4ba358895

Which contains:
14 Invoice & Statement of Account for JULY 2021,pdf.ppam
c53ca10d6aa2f4dd9d7cba4ca14bec24

AGGAH PAYLOAD DOWNLOAD URLS
http://bitly.com/ddwddgwfwowklwooooi

which points to:
https://fckusecurityresearchermotherfkrs.blogspot.com/p/15_17.html

FOLLOW UP PAYLOAD URLS
https://35d42729-3b2d-44cd-88c7-59a76492301c.usrfiles.com/ugd/35d427_aba34aefaf6944578eaddcbf518b0d51.txt
https://92c49223-b37f-4157-904d-daf4679f14d5.usrfiles.com/ugd/92c492_31d30f382d85478e8fe7e5f1d2052054.txt
http://1230948%[email protected]/p/15.html

PAYLOAD FILE HASHES EXTRACTED FROM TEXT FILES
1stPayload.exe
6a7ae0e207f646c9e5b876196cf736e4

2ndPayload.exe
49e8b5130c4421276e268198d714778b

AVE MARIA/WARZONE C2
emalifegogo.duckdns.org

STRINGS FOUND IN MEMORY OF THE ASPNET_COMPILER.EXE PROCESS
Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper
C:\Users\Vitali Kremez\Documents\MidgetPorn\workspace\MsgBox.exe

SUPPORTING EVIDENCE
https://www.virustotal.com/gui/file/6c132e1219d1a4210edeb5dd367568f16f08ddf1ca794a32bf067c22b3e9a113/detection
https://www.virustotal.com/gui/file/17c8a8ef913ea0a4dbb41e6e55e35c28afade971935457caa44b362b9eec8eb9/detection