AveMaria Info-stealer Changes its Strategy to Infect More Users

Recent observations

• Most of these attacks were initiated via phishing emails and the first one was first identified in August 2022. 
• The phishing emails included an ISO file attachment, along with three decoy documents and four shortcut files, and were used to target the Ukrainian officials.

AveMaria’s previous occurrences

• In December 2022, experts uncovered two versions AveMaria attack chain that leveraged the Virtual Hard Disk file format to drop the malicious downloader.  While adversaries used a malicious .vhdx file to download the malware in one scenario, they leveraged the type casting or type conversion mechanisms (to manipulate the values at the bit level) and dropped a .vhd file as the initial payload.
• In October 2022, the malicious payload was dropped via AUloader. The phishing campaign leveraged a highly obfuscated Autoit script and Autoit interpreter to decrypt the AveMaria binary in memory and then execute the payload.
• In September 2022, VBscript and DLL injection techniques were used during the execution stages to evade detection. The campaign targeted Serbian users by requesting them to update their login credentials for access to the government e-identification portal.

What does this indicate?

• Researchers highlight that developers of the AveMaria malware are actively maintaining the malware and updating the phases and stages of execution with new tactics to evade detection.
• The changes to the malware distribution mechanisms were updated monthly so that even if one mechanism was flagged by security operators the other can still be applied effectively.

Conclusion