Resubmissions

18/05/2025, 12:52

250518-p336dsdp3z 10

18/05/2025, 12:31

250518-pqacjsdl71 10

General

  • Target

    https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/LuminosityLink

  • Sample

    250518-p336dsdp3z

Malware Config

Targets

    • Target

      https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/LuminosityLink

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzonerat family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Server Software Component: Terminal Services DLL

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

    • Drops file in System32 directory

    • Hide Artifacts: Hidden Users

MITRE ATT&CK Enterprise v16

Tasks