Loading malware…
Warzone RAT, also known as AveMaria, is a commodity Windows remote access trojan first seen in 2018 and widely used in cybercrime operations. It provides full remote access to compromised systems and supports interactive control through remote desktop functionality, including hidden VNC access to reduce user visibility. Reported capabilities include credential theft from web browsers and email clients, cookie theft, keylogging, webcam access, file and process management, remote shell execution, data exfiltration, and use of PowerShell to download additional content and execute commands. The malware has also been associated with privilege-escalation behavior through UAC bypass techniques, registry modification, and DLL injection into other processes, as well as defense evasion through disabling or weakening Windows Defender during elevation workflows. Warzone RAT has commonly been delivered through malicious email attachments that require victim interaction to execute, making phishing and spearphishing a frequent infection vector. It has been used by multiple criminal actors, including activity attributed to Scattered Spider, to steal credentials, cookies, and other information from compromised environments. In February 2024, an FBI-led international law enforcement operation disrupted infrastructure associated with the malware and arrested individuals accused of selling and supporting it.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Associated Analytic Story AgentTesla CVE-2023-21716 Word RTF Heap Corruption Compromised Windows Host FIN7 PlugX Warzone RAT
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Apart from the above legitimate tools used for malicious purposes, Scattered Spider also conducts phishing attacks to install malware like the WarZone RAT, Raccoon Stealer, and Vidar Stealer, to steal from compromised systems login credentials, cookies, and other data useful in the attack.
For remote access, YoroTrooper has also deployed commodity malware, such as AveMaria/Warzone RAT, LodaRAT and Meterpreter.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
This malware, used by the mentioned groups, can infiltrate the infrastructure in various ways, from exploiting Spear-Phishing to compromising websites where it is downloaded.
persistence_autorun_tasks Installs itself for autorun at Windows startup ... uses_windows_utilities_to_create_scheduled_task Uses Windows utilities to create a scheduled task
suspicious_command_tools Uses suspicious command line tools or Windows utilities ... cmdline_obfuscation Appears to use command line obfuscation ... cmdline_terminate Executed a command line with /C or /R argument to terminate command shell on completion
createtoolhelp32snapshot_module_enumeration Enumerates the modules from a process (may be used to locate base addresses in process injection)
This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host.
Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
persistence_autorun_tasks Installs itself for autorun at Windows startup ... uses_windows_utilities_to_create_scheduled_task Uses Windows utilities to create a scheduled task
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
persistence_autorun_tasks Installs itself for autorun at Windows startup ... uses_windows_utilities_to_create_scheduled_task Uses Windows utilities to create a scheduled task
Once the sample achieves persistence, the files are launched in the desired folder, and the appropriate privileges are obtained, it commonly proceeds with the injection process.
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
A common practice in AveMaria RAT is privilege escalation or bypassing UAC. The most common method involves abusing sdclt.exe
Avaddon modifies several registry keys for persistence and UAC bypass ... Lokibot has modified the Registry as part of its UAC bypass process ... Shamoon ... modify the Registry to disable UAC remote restrictions by setting ... LocalAccountTokenFilterPolicy to 1.
multiple_useragents Network activity contains more than one unique useragent ... network_fake_useragent Fake User-Agent detected
Once the sample achieves persistence, the files are launched in the desired folder, and the appropriate privileges are obtained, it commonly proceeds with the injection process.
deletes_executed_files Deletes executed files from disk ... deletes_self Deletes its original binary from disk ... anomalous_deletefile Anomalous file deletion behavior detected (10+)
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
antivm_generic_system Checks the system manufacturer, likely for anti-virtualization ... antisandbox_sboxie_libs Detects Sandboxie through the presence of a library ... antivm_generic_diskreg Checks the presence of disk drives in the registry, possibly for anti-virtualization ... antivm_checks_available_memory Checks available memory
The executions vary greatly depending on the version, but typically it tries to determine if it is already running on the machine using a Mutex After that, it can perform anti-dbg/Anti-VM tasks or directly check for security software that may be installed on the system
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. APT28 has used the WindowStyle parameter to conceal PowerShell windows.
persistence_ads Attempts to interact with an Alternate Data Stream (ADS)
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
A group of remote access trojans, among them WarZoneRAT, njrat, nanocore, and netwire, overlap on process injection, keylogging-related calls, and command-and-control traffic.
CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
infostealer_browser Steals private information from local Internet browsers ... infostealer_cookies Touches a file containing cookies, possibly for information gathering ... infostealer_ftp Harvests credentials from local FTP client softwares ... registry_credential_store_access Accessed credential storage registry keys ... credential_access_via_windows_credential_history Attempts to access Users Windows Credential History File that is used by Microsoft’s DPAPI
enumerates_running_processes Enumerates running processes ... process_interest Expresses interest in specific running processes
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
antivm_generic_system Checks the system manufacturer, likely for anti-virtualization ... antisandbox_sboxie_libs Detects Sandboxie through the presence of a library ... antivm_generic_diskreg Checks the presence of disk drives in the registry, possibly for anti-virtualization ... antivm_checks_available_memory Checks available memory
The executions vary greatly depending on the version, but typically it tries to determine if it is already running on the machine using a Mutex After that, it can perform anti-dbg/Anti-VM tasks or directly check for security software that may be installed on the system
A group of remote access trojans, among them WarZoneRAT, njrat, nanocore, and netwire, overlap on process injection, keylogging-related calls, and command-and-control traffic.
Typically, the malware will have different addresses to attempt to gain access. It will commonly try to establish a connection by opening a socket to the chosen address.
antiav_detectfile Attempts to identify installed AV products by installation directory ... antiav_servicestop Attempts to stop active services ... disables_windowsupdate Attempts to disable Windows Auto Updates ... antiav_avast_libs Detects Avast Antivirus through the presence of a library
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
98 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan associated here with process injection, keylogging-related calls, and command-and-control traffic.
Associated Analytic Story ... Hermetic Wiper Warzone RAT Phemedrone Stealer Prestige Ransomware ...
Referenced only as part of an associated analytic story list.
Referenced as an associated analytic story in the context of Office applications dropping executables or scripts on Windows, a behavior linked to phishing-driven malware delivery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.