Check Point Warzone Feb 2020

WarzoneRAT can collect data from a compromised host.

WarzoneRAT can include a rootkit to hide processes, files, and startup.

WarzoneRAT has the ability to control an infected PC using RDP.

WarzoneRAT has the ability of performing remote desktop access via a VNC console.

WarzoneRAT can send collected victim data to its C2 server.

WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.

WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.

WarzoneRAT can obtain a list of processes on a compromised host.

WarzoneRAT can use PowerShell to download files and execute commands.

WarzoneRAT can use `cmd.exe` to execute malicious code.

WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.

WarzoneRAT can enumerate directories on a compromise host.

WarzoneRAT has the capability to act as a reverse proxy.

WarzoneRAT can communicate with its C2 server via TCP over port 5200.

WarzoneRAT can download and execute additional files.

WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.

WarzoneRAT can access the webcam on a victim's machine.

WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.

WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.

WarzoneRAT can perform COM hijacking by setting the path to itself to the `HKCU\Software\Classes\Folder\shell\open\command` key with a `DelegateExecute` parameter.

WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.

WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.

WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.

WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide its attempts to elevate privileges through `IFileOperation`.

WarzoneRAT has been distributed as a malicious attachment within an email.

WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.

WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.