Genel Bakis

Bu ornek, PDB izinde Ring3 CRAT x64 adi gecen ve icinde warzoneTURBO string'i barindiran 156KB'lik credential harvesting RAT'dir. Chrome, Edge, Epic Privacy Browser ve Firefox'tan sifre cesni yaparken process injection ve Windows BCrypt API kullanan bu RAT, WarzoneRAT altyapisindan yararlanmaktadir.

Teknik Analiz

WarzoneRAT / Ring3 CRAT Tespiti

  • PDB: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb
  • warzoneTURBO — WarzoneRAT turbo modu goruntusu
  • Injecting64 — 64-bit injection metodu

Tarayici Kimlik Bilgisi Calma

select signon_realm, origin_url, username_value, password_value from logins
select signon_realm, origin_url, username_value, password_value from wow_logins
  • Chrome: \Google\Chrome\User Data\Default\Login Data
  • Edge: \Microsoft\Edge\User Data\Local State
  • Epic Privacy Browser: \Epic Privacy Browser\User Data\Default\Login Data
  • Firefox: PK11SDR_Decrypt, PK11_CheckUserPassword
  • encryptedUsername, encryptedPassword — Firefox sifreli alanlar

BCrypt API Sifre Cozme

  • BCryptDecrypt — Chrome sifre cozme
  • BCryptOpenAlgorithmProvider — algoritma saglayicisi
  • BCryptSetProperty — AES-GCM ozelligi
  • BCryptGenerateSymmetricKey — simetrik anahtar

Process Injection

  • VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
  • URLDownloadToFileW — ikincil payload indirme

Izleri Silme

cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q

Teknik Ozellikler

OzellikValor
FormatPE32 GUI Intel 80386
Tamaño156.160 bayt
Entropi6.37 (normal)
HedeflerChrome, Edge, Epic, Firefox
KriptoBCrypt (AES-GCM decryption)
InjectionVirtualAllocEx+WriteProcessMemory+CreateRemoteThread
GelistiriciW7H64

IOC Ozeti

  • SHA256: fee959ff12e4ac5df67164ed83565a768d1286263bed759a32dcbe668ef6390f

WarzoneRAT — Perfil del malware

WarzoneRAT Ave Maria RAT. 2026 itibariyla aktif. Tarih prefixli dagitim. Config karması 45A06E. Uclu anti-debug.

Tipo de malware
RAT
Lenguaje de programación
C++
Protocolo C2
TCP
Sistemas objetivo
Windows
También conocido como (AKA)
Ave Maria

Detalles técnicos

C++, AES-256 sifreleme, TCP, Hidden VNC, DVD kamera, Stealer, Privilege escalation, Anti-sandbox (CPUID kontrol), Bot iletisimi JSON tabanli

Atribución / Actor de amenaza

Daniel Meli (Malta) tarafindan yonetilen MaaS operasyonu. 2024'te FBI tarafindan tutuklanmis ve botnet altyapisi cokertilmistir.

Capacidades y comportamiento

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

Lista IOC (1 indicadores)

IOC — WarzoneRAT
# SHA256 fee959ff12e4ac5df67164ed83565a768d1286263bed759a32dcbe668ef6390f
TipoValorNota
sha256 fee959ff12e4ac5df67164ed83565a768d1286263bed759a32dcbe668ef6390f
WarzoneRAT — Ver perfil completo →

Servidores C2 (2 servidores registrados para esta familia)

Dirección Tipo Puerto Protocolo Estado País
185.216.36.143 ip 4500 TCP inactive BG
cloudflareprotected.xyz domain 5200 TCP inactive RU

Las direcciones C2 se proporcionan únicamente a partir de muestras de malware verificadas manualmente por el equipo KEYDAL. Se prohíbe el uso comercial.

Etiquetas
warzoneratring3-cratstealerchromeedgefirefoxbcryptaes-gcmpk11sdrcredentialinjectioncreateremotethreadw7h64