Ring3 CRAT x64 / WarzoneRAT: warzoneTURBO, Chrome+Edge+Firefox BCrypt Sifre, PK11SDR_Decrypt, Injecting64

Genel Bakis

Bu ornek, PDB izinde Ring3 CRAT x64 adi gecen ve icinde warzoneTURBO string'i barindiran 156KB'lik credential harvesting RAT'dir. Chrome, Edge, Epic Privacy Browser ve Firefox'tan sifre cesni yaparken process injection ve Windows BCrypt API kullanan bu RAT, WarzoneRAT altyapisindan yararlanmaktadir.

Teknik Analiz

WarzoneRAT / Ring3 CRAT Tespiti

• PDB: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb
• warzoneTURBO — WarzoneRAT turbo modu goruntusu
• Injecting64 — 64-bit injection metodu

Tarayici Kimlik Bilgisi Calma

select signon_realm, origin_url, username_value, password_value from logins
select signon_realm, origin_url, username_value, password_value from wow_logins

• Chrome: \Google\Chrome\User Data\Default\Login Data
• Edge: \Microsoft\Edge\User Data\Local State
• Epic Privacy Browser: \Epic Privacy Browser\User Data\Default\Login Data
• Firefox: PK11SDR_Decrypt, PK11_CheckUserPassword
• encryptedUsername, encryptedPassword — Firefox sifreli alanlar

BCrypt API Sifre Cozme

• BCryptDecrypt — Chrome sifre cozme
• BCryptOpenAlgorithmProvider — algoritma saglayicisi
• BCryptSetProperty — AES-GCM ozelligi
• BCryptGenerateSymmetricKey — simetrik anahtar

Process Injection

• VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
• URLDownloadToFileW — ikincil payload indirme

Izleri Silme

cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q

Teknik Ozellikler

IOC Ozeti

• SHA256: fee959ff12e4ac5df67164ed83565a768d1286263bed759a32dcbe668ef6390f