2021-07-19 WarZone IOCs

THREAT IDENTIFICATION:  AVEMARIA STEALER / WARZONE RAT

SUBJECTS OBSERVED
Attn: Order Department

SENDERS OBSERVED
admincarax@vh283.sweb.ru

EMAIL BODY
Hi,

We are very much interested in your product and services urgently,

Can you please send me your company active phone number? because have called your office phone but cannot connect to you

Please can your company supply necessary document with  quotation  to the exact production sample picture as attached?

Awaiting your swift response.

Thank you

Regards,

DAVE MAKR
Procurement Officer
Al Saeid Trading Co.LLC
Mike Building,2nd Floor
Gabil Street,
Al Balad Dist (Down Town),
Jeddah,KSA
Telephone : 920008292

MALDOC FILE HASHES
picture.zip
6baddbce995ec8723d9ab85da6fe6032

AVE MARIA PAYLOAD FILE HASHES
Full drawing and specification of needed materials with two different sample as seen requested.exe
d4c6a1bb7773aa6b1d128f6eacd75add

AVE MARIA C2
176.31.159.203:5200

SUPPORTING EVIDENCE
Strings in memory
Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper