WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI’s recent efforts to dismantle its operations.

Initially detected in 2018, WarzoneRAT was disrupted by the FBI in mid-February when they seized the malware’s infrastructure and arrested two individuals linked to the cybercrime scheme.

However, ThreatMon’s recent advertisement for WarZoneRAT v3, with its enhanced features, indicates that the threat actors are far from giving up.

Cybersecurity experts at Cyble Research & Intelligence Labs (CRIL) have uncovered a new campaign that leverages tax-themed spam emails to spread the WarzoneRAT (Avemaria) malware, a Remote Administration Tool (RAT) known for its remote control capabilities and ability to execute malicious actions under the command of a remote server.

Infection Tactics: The LNK and HTA Files

The infection begins when unsuspecting users open an email with the subject “taxorganizer2023” and execute an attached archive file.

Download Free CISO’s Guide to Avoiding the Next Breach

Are you from The Team of SOC, Network Security, or Security Manager or CSO? Download Perimeter’s Guide to how cloud-based, converged network security improves security and reduces TCO.

• Understand the importance of a zero trust strategy
• Complete Network security Checklist
• See why relying on a legacy VPN is no longer a viable security strategy
• Get suggestions on how to present the move to a cloud-based network security solution
• Explore the advantages of converged network security over legacy approaches
• Discover the tools and technologies that maximize network security

Adapt to the changing threat landscape effortlessly with Perimeter 81’s cloud-based, unified network security platform.

Download Perimeter 81 Free PDF Guide

This file contains a deceptive shortcut file, “taxorganizer2023.png.lnk,” which appears to be an image but is, in fact, a malicious LNK file.

When executed, it triggers a PowerShell command to download and extract a ZIP file, leading to the execution of an HTA file.

This HTA file retrieves a PowerShell script in memory, which downloads a VBScript file from a remote server, ultimately deploying the WarzoneRAT malware.

Another infection method involves a ZIP archive named “MY TAX ORGANIZER.zip,” which contains a legitimate EXE file, a malicious DLL, and a PDF file.

Running the EXE file triggers the DLL sideloading technique, loading the malicious DLL identified as WarzoneRAT.

Technical Analysis: Unpacking the Malware

The technical analysis of the campaign reveals a complex infection chain.

The LNK file downloads a PNG file, which is a ZIP file, and extracts its contents.

The subsequent execution of the HTA file leads to a series of scripts that perform various actions, including generating random equations for stealth, checking for antivirus processes, and creating directories and files for persistence.

Final Payload: The Dangers of WarzoneRAT

The final payload, WarzoneRAT (Avemaria), is a highly capable RAT that allows remote access and control over the victim’s computer.

It can exfiltrate data, escalate privileges, manipulate the desktop remotely, harvest credentials, and perform keylogging, among other intrusive activities.

The recent campaign highlights the persistent threat posed by cybercriminals who exploit the trust of users with themed spam emails.

The sophisticated techniques used in this campaign, such as reflective loading and DLL sideloading, underscore the importance of vigilance and robust cybersecurity measures.

As the WarzoneRAT malware continues to evolve and resurface, it is a stark reminder of the ongoing battle between cybercriminals and cybersecurity defenders.

Users are urged to exercise caution when opening email attachments, even those that appear to be related to timely and relevant topics like tax organization.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.