Loading malware…
Warzone RAT, also widely known as Ave Maria, is a Windows remote access trojan sold as a commodity malware offering and used in both cybercrime and espionage-oriented intrusion chains. Active since at least 2018, it provides attackers with persistent remote control over infected systems and has appeared in campaigns targeting government personnel, military-related users, and general enterprise and consumer victims. Observed lures have included themed spam around COVID-19, Ukraine-related donation and scam messaging, and government-themed documents, particularly malicious Office files and archives.
The malware supports a broad set of surveillance and remote administration functions. Reported capabilities include keylogging, credential theft from numerous web browsers, theft of credentials from Outlook and Thunderbird, screenshot capture, webcam capture, remote desktop access through hidden VNC functionality, arbitrary command execution, reverse shell capability, file download and execution, and use of PowerShell for follow-on activity. Warzone RAT has also been observed using process injection and process hollowing to execute within legitimate processes for defense evasion.
Privilege escalation and stealth are notable aspects of the family. Documented variants can bypass Windows User Account Control using techniques involving sdclt.exe on Windows 10, IFileOperation on older Windows versions, and other UAC bypass chains seen in the wild. Hidden-window and hVNC functionality reduce user visibility during attacker interaction. Some functionality appears to borrow from TinyNuke, including hidden VNC and reverse SOCKS proxy-related features.
Warzone RAT is commonly delivered through phishing and malspam, often via malicious Office documents, macro-enabled files, exploit-laden attachments, JavaScript, PowerShell droppers, and intermediary loaders. Campaigns have used CVE-2017-11882 for initial execution, Discord-hosted payload delivery, and loaders such as DBatLoader and PrivateLoader. It has also been deployed in campaigns assessed as resembling activity associated with Transparent Tribe and SideCopy, and has been distributed alongside or after other commodity malware families.
The malware targets Windows systems and is frequently used for credential theft, surveillance, and post-compromise remote control. Its combination of low cost, broad functionality, and flexible delivery has made it a recurring payload across commodity malware operations and targeted phishing campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The malicious spam messages were crafted to exploit CVE-2017-11882. The remote code execution flaw is specific to Microsoft Word Equation Editor. Once exploited, the Warzone RAT payload is downloaded and installed. | From May 21st onward, we observed multiple COVID-themed spam campaigns distributing the Warzone RAT. The malicious spam messages were crafted to exploit CVE-2017-11882.
Associated Analytic Story AgentTesla CVE-2023-21716 Word RTF Heap Corruption Compromised Windows Host FIN7 PlugX Warzone RAT
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos recently discovered a malicious campaign targeting government employees and military personnel in the Indian sub-continent with two commercial and commodity RAT families known as NetwireRAT (aka NetwireRC) and WarzoneRAT (aka Ave Maria).
In some cases, the final stage PowerShell script contained up to seven various RATs. These are typically NjRat, BitRat, Nanocore RAT, QuasarRat, LimeRat, and Warzone.
To give an overview, here is a list of all observed tools and malware types the actor has been using in recent years: Warzone RAT / AveMaria RAT
Apart from the above legitimate tools used for malicious purposes, Scattered Spider also conducts phishing attacks to install malware like the WarZone RAT, Raccoon Stealer, and Vidar Stealer, to steal from compromised systems login credentials, cookies, and other data useful in the attack.
For remote access, YoroTrooper has also deployed commodity malware, such as AveMaria/Warzone RAT, LodaRAT and Meterpreter.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
This report details a specific phishing campaign used to distribute the Agent Tesla RAT. The lure in the emails is centered around updates to COVID-specific PPE.
The back.htm executed via ddond.com, runs powershell command to download another powershell script later executing it via Invoke-Expression. And schedules a task using schtasks.exe for persistence.
It can also download and execute additional malware, giving attackers even more control over the victim’s system.
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'
These maldocs contain malicious VBA macros that download and execute the next stage of the infection — the malware loader. | The macro in the maldoc downloads and executes a VBScript (VBS) instead of directly downloading the malware payload.
The malicious document launches EXCEL.exe and executes wscript.exe to run Update.js javascript which is embedded in the macro itself and copy the Update.js to Startup Folder.
The malicious spam messages were crafted to exploit CVE-2017-11882. The remote code execution flaw is specific to Microsoft Word Equation Editor.
Warzone RAT is typically spread through phishing emails or other social engineering techniques, where attackers trick victims into downloading and installing the malware on their systems.
The back.htm executed via ddond.com, runs powershell command to download another powershell script later executing it via Invoke-Expression. And schedules a task using schtasks.exe for persistence.
The powershell script executed via Invoke-Expression executes embedded WarzoneRat and other .Net binary payloads via process hollowing technique... The “Execute” Function then uses process hollowing technique to inject malicious code into legit processes such as aspnet_compiler.exe, aspnet_regbrowsers.exe, CasPol.exe, RegAsm.exe and MSBuild.exe.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Later the JS script copies the mshta from C:\Windows\System32 to C:\ProgramData\ and names it as ‘ddond.com’. It then launches ddond.com(masqueraded mshta)...
The powershell script executed via Invoke-Expression executes embedded WarzoneRat and other .Net binary payloads via process hollowing technique... The “Execute” Function then uses process hollowing technique to inject malicious code into legit processes such as aspnet_compiler.exe, aspnet_regbrowsers.exe, CasPol.exe, RegAsm.exe and MSBuild.exe.
The PowerShell downloads a malicious archive and an unzip utility such as 7-Zip from a remote location. This utility unzips and runs the malware payload from the archive file.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Once the malware is installed, it can perform a variety of malicious actions, including stealing passwords, taking screenshots, and logging keystrokes.
Netwire is a highly versatile RAT consisting of multiple capabilities including: Stealing credentials from browsers.
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, enumerating PIDs, checking for specific process names, or using APIs such as CreateToolhelp32Snapshot and commands such as tasklist and ps.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
WARZONE RAT – Beware Of The Trojan Malware Stealing Data Triggering From Various Office Documents
Once the malware is installed, it can perform a variety of malicious actions, including stealing passwords, taking screenshots, and logging keystrokes.
461 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
146 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan delivered via COVID-themed spam exploiting Microsoft Word Equation Editor RCE.
A remote access trojan associated here with process injection, keylogging-related calls, and command-and-control traffic.
Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT / BitRAT / PandoraHVNC – Part I
Associated Analytic Story ... Hermetic Wiper Warzone RAT Phemedrone Stealer Prestige Ransomware ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.