The ‘AVE_MARIA’ Malware

guest · Jan 11, 2019

The ‘AVE_MARIA’ Malware
January 11, 2019
https://securityaffairs.co/wordpress/79757/malware/the-ave_maria-malware.html

The Cybaze-Yoroi ZLab researchers analyzed phishing attempts spreading in the last days of the past year against an Italian organization operating in the Oil&Gas sector.

The actual infection chain starts from the self-extracting archive (SFX) dropped by after the opening of the malicious Office document. The file is a WinRAR self-extractor configured to unpack its contents into the temporary folder “%TEMP%\04505187” and then silently run a specific setup routine:
[...]
It is interesting the way used by the AutoIt script to run the just extracted payload. In the first instance, the malware creates a copy of legit Regsvcs.exe, the .NET Services Installation Tool, into %TEMP% folder and runs it. Then, it performs a process injection in order to start the malicious payload behind the Regsvcs process.

In addition, the malware embeds an utility able to bypass the User Access Control within the resource section. It abuses a vulnerability of the “pkgmgr.exe” Windows tool; many resources related to this exploit are publicly available on the internet.
Click to expand...

Further details, including IoCs and Yara rules are included in the report published in the Yoroi blog
Click to expand...

guest · Mar 3, 2019

Threat Alert: AVE Maria infostealer on the rise with new Stealthier delivery
March 1, 2019
http://blog.morphisec.com/threat-al...aler-on-the-rise-with-new-stealthier-delivery

While previous coverage of the malware reported the use of AutoIt as part of the AVE_MARIA downloader stage, the campaign identified by Morphisec uses additional, more advanced stealth methods to deliver the same information stealer.
More specifically, we have identified the adoption of Orcus RAT delivery stages and Revenge RAT fileless components that execute reconnaissance and hollowing attacks on legitimate Windows processes to avoid being detected.
PHISHING
Following a successful email phishing campaign, a malicious VBScript is executed. This VBScript contains a PowerShell command that downloads an initial Recon stage component.
FIRST STAGE RECON DOWNLOAD
The first stage PowerShell command downloads the RevengeRat component directly into memory [...] then executes the next stage PowerShell command.
SECOND STAGE DOWNLOADER [...] executes a known process hollowing technique on a legitimate Windows process (RegAsm.exe). This is done to bypass whitelisting. [...]
CONCLUSIONS
There is an obvious adaptation of various memory evasion techniques by the different hacker groups.
Click to expand...

Log in or Sign up

The ‘AVE_MARIA’ Malware

guest Guest

guest Guest

Log in or Sign up

The ‘AVE_MARIA’ Malware

guest Guest

guest Guest

Useful Searches