Tag Archives: AveMaria Info Stealer

Fake order delivering AveMaria stealer with difficult office doc.

My Online Security Posted on by 3

I had a bit of  a problem trying to analyse this malware today. The word doc looks pretty average at first glance, but trying to run it in Anyrun  on a W7 32 or 64 bit version of windows. gave me VBA errors. It also wouldn’t run on 64 bit versions of W8.1 or W10, giving the same VBA errors  I then tried to upload to IRIS-H analysis where it crashed. It wouldn’t even upload to Hybrid analysis using either 32 bit W7 or 64 bit. I think Anyrun uses Office 2010 on W7 and Office 2013 on W8.1. I … Continue reading →

Ave Maria infostealer keylogger via Fake Invoice order confirmation

My Online Security Posted on by  

Ave Maria info stealer & keylogger is a relatively new malware that appeared rather suddenly towards the end  last year 2018. We don’t see much of it in UK and most examples I have heard of are from Italy and have been targeting Italian companies, so this is quite unusual and is not a well known malware (yet). This arrived with an Excel spreadsheet attachment to a fake invoice / order  email. The miscreants are using CVE-2017-11882 to download the payload from a remote URL  http://23.249.164.131/feb/sel/sel.exe  This in turn calls out to a github account where what look like genuine  digitally … Continue reading →