AveMariaRAT

This malware, used by the mentioned groups, can infiltrate the infrastructure in various ways, from exploiting Spear-Phishing to compromising websites where it is downloaded.

This malware, used by the mentioned groups, can infiltrate the infrastructure in various ways, from exploiting Spear-Phishing to compromising websites where it is downloaded.

A common practice I have observed in WarZone RAT is modifying network elements, as well as modifying keys like \CurrentVersion\Internet Settings

After this, it is common for the malware to establish persistence. Depending on the sample, it may create a copy of itself and then add the path to \CurrentVersion\Run (or similar) registry key, or it may leave a copy of itself or a script in a startup folder that will be executed on system startup

Once the sample achieves persistence, the files are launched in the desired folder, and the appropriate privileges are obtained, it commonly proceeds with the injection process.

After this, it is common for the malware to establish persistence. Depending on the sample, it may create a copy of itself and then add the path to \CurrentVersion\Run (or similar) registry key, or it may leave a copy of itself or a script in a startup folder that will be executed on system startup

A common practice in AveMaria RAT is privilege escalation or bypassing UAC. The most common method involves abusing sdclt.exe

Once the sample achieves persistence, the files are launched in the desired folder, and the appropriate privileges are obtained, it commonly proceeds with the injection process.

The executions vary greatly depending on the version, but typically it tries to determine if it is already running on the machine using a Mutex After that, it can perform anti-dbg/Anti-VM tasks or directly check for security software that may be installed on the system

Commonly, it extracts the code from a specific section and constructs it in memory for subsequent injection. Alternatively, it may assemble or deobfuscate the code from a resource.

During the analysis of different samples, I notice the consistent use of various anti-debugging techniques along with frequent sleep commands that significantly slow down debugging.

A common practice I have observed in WarZone RAT is modifying network elements, as well as modifying keys like \CurrentVersion\Internet Settings

It is common to launch them in a folder like Documents or Downloads and modify the attributes to point to another location, such as ApplicationData or ProgramData.

At this point, the most common action is to gather relevant information about the device and/or the user, such as the operating system type, machine name, language used, etc.

The executions vary greatly depending on the version, but typically it tries to determine if it is already running on the machine using a Mutex After that, it can perform anti-dbg/Anti-VM tasks or directly check for security software that may be installed on the system

At this point, the most common action is to gather relevant information about the device and/or the user, such as the operating system type, machine name, language used, etc.

During the analysis of different samples, I notice the consistent use of various anti-debugging techniques along with frequent sleep commands that significantly slow down debugging.

Typically, the malware will have different addresses to attempt to gain access. It will commonly try to establish a connection by opening a socket to the chosen address.

Once the connection is established, the attacker has achieved the desired objective: a malware injected into a process, whether legitimate or not, from which they can operate.