{"id":2698,"date":"2024-09-25T19:29:57","date_gmt":"2024-09-25T19:29:57","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2698"},"modified":"2025-07-29T06:08:56","modified_gmt":"2025-07-29T06:08:56","slug":"chinese-warat-give-attackers-full-control-of-compromised-machines","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/chinese-warat-give-attackers-full-control-of-compromised-machines\/","title":{"rendered":"Chinese waRAT give attackers full control of compromised machines"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

During LMNTRIX Hunt activities for one of our Telco clients, we discovered a Remote Access Trojan on its network which had completely bypassed the client\u2019s traditional anti-virus solutions. 

This piece of malware, dubbed waRat, could have given the attacker complete remote access to client\u2019s environment. We\u2019ve found no evidence of spearphishing as the delivery mechanism, and instead believe this ended up on the client\u2019s network via drive-by download.

Drive-by downloads are performed by redirecting users over a malicious site, or a compromised domain with injected malicious scripts, that download files without user consent. Unlike spearphishing campaigns, they don\u2019t require the user to click on or download the malicious content. In this case, a malicious website (nesbbc[.]top) delivered waRAT after a user navigated to the site \u2013 most probably while meaning to reach newsbbc[.]com. 

After further analysing the malicious domain directories, we collected over 15 different variations of the malware.

We believe waRAT was designed specifically to target organisations in China and Taiwan as during the infection cycle, it seeks out and disables 360 Security AV \u2013 Chinese and Taiwanese businesses being the largest 360 Security customer base. 

The malware is also able to spread laterally through an environment by writing autorun files in all attached volumes. This means that anytime a removable device is attached, it is also infected and becomes the carrier, compromising other devices once inserted. 

Malware Analysis<\/strong><\/ins> 

Static Analysis<\/strong>

Filename: waNewRat360.exe

Sha256: 4222660b39aff67a4a5712a800f26e481c9b8867e6d3b19761d8df283f7b14ed

Company Name: 360\u5b89\u5168\u536b\u58eb\u4e3b\u7a0b\u5e8f (360 Security)

File Name: 360.cn

The file is a PE32 executable, written in C++. The executable contains many hidden functions, only accessible to the attacker by creating multiple threads. The resources are in Chinese Simplified language. Yara rules match with waRAT payloads from the attacker group, juewangzhe[.]net.

Dynamic Analysis<\/strong>

The malware tries to evade analysis by hiding active threads from debugger using \u201cZwSetInformationThread API\u201d and calculates execution time using \u201cGetTickCount\u201d. The following is the malware\u2019s execution flow as witnessed in our isolated environment.

Flow \u2013<\/p>\n\n\n\n