YoroTrooper's AveMaria RAT Dropper Stacks Five Evasion Layers Before C2 Contact
Two new file indicators tied to YoroTrooper's AveMaria RAT campaign reveal a dropper deploying five discrete anti-analysis mechanisms before beaconing to a Microsoft-themed C2 domain pair registered through NameCheap with Kazakhstan-geolocated WHOIS. The parent domain has since entered DNS redemption and hold status, while the operational subdomain continues to resolve independently — a split lifecycle that points to deliberate architectural separation.
A Five-Layer Evasion Stack and a Parking-Lot C2: AveMaria RAT's Operational Fingerprint
Since CTX Team's earlier coverage of a WarzoneRAT cluster targeting Turkish organisations, two new file indicators have surfaced alongside the same Microsoft-themed infrastructure backbone — and the tradecraft picture they reveal is considerably more elaborate than a routine IOC refresh. The primary dropper, a 668-kilobyte Win32 PE32 executable catalogued under SHA-256 69415b18aeb7e75f4843313ed5c65e09b1a2a41d73af0ce7fed40e0f2cc2b0a0, stacks five discrete anti-analysis mechanisms before it ever places a call to its command-and-control endpoint: timing-based sandbox evasion through long sleeps and direct CPU clock access, debugger detection, UAC bypass via the open-source UACMe toolkit, process injection, and ICMP-based host discovery. Zenbox classified the sample as EVADER — a verdict that sits alongside MALWARE, PHISHING, and TROJAN in the same sandbox run — and four Snort IDS rules fired during execution, including PROTOCOL-ICMP Unusual PING detected at medium severity. The payload family confirmed in that sandbox run is AveMaria RAT, the same remote-access trojan family that public reporting has long associated with the threat actor tracked as YoroTrooper.
The infrastructure picture is equally instructive. The C2 domain pair — msoftupdate.me and remote.msoftupdate.me — was co-registered on 2022-05-25 through NameCheap, Inc., with WHOIS registrant country listed as Kazakhstan (KZ) and organisation and state fields deliberately obfuscated as hex-like strings (8158f4b848840d9f and a4d2ad5d9d67109a respectively). The parent domain has since entered DNS redemption and pendingDelete status, resolving now via a CNAME to the parking service 77980.bodis.com. The operational subdomain remote.msoftupdate.me, however, continues to resolve independently to 45.79.244.209 and retains its TLS certificate record — a split lifecycle that reveals deliberate architectural separation designed to outlast parent-domain abandonment or seizure.
CTX Team has classified this cluster at confidence 85, with the evidence pack rated low overall (score 30/100) given only three substantively characterised IOCs and one file hash that is entirely opaque to VirusTotal analysis.
The Dropper's Evasion Architecture: Five Layers Before First Contact
The dropper at 69415b18aeb7e75f4843313ed5c65e09b1a2a41d73af0ce7fed40e0f2cc2b0a0 is not a minimalist loader. Its VirusTotal tag set — long-sleeps, direct-cpu-clock-access, runtime-modules, spreader, peexe — reads as a checklist of deliberate anti-analysis decisions, each targeting a different layer of the detection stack.
The first two tags map directly to MITRE T1497.003, timing-based sandbox evasion. Long-sleep techniques exploit the finite execution window that most automated sandboxes allocate per sample: a dropper that sleeps for several minutes before executing its payload will simply time out in environments that cap runs at 60 or 90 seconds, producing a clean verdict. The direct-cpu-clock-access tag is more technically specific — it indicates the sample reads CPU timestamp counter registers (RDTSC or equivalent) to measure elapsed wall-clock time independently of the operating system's timer APIs. Because virtualised sandboxes often accelerate or manipulate OS-level timers to compress execution, a dropper that bypasses those APIs and reads the hardware clock directly can detect the discrepancy and abort. Zenbox's EVADER classification confirms this evasion architecture was effective enough to warrant a dedicated verdict category, and the co-occurrence of T1622 (debugger evasion) in the campaign's MITRE technique set is consistent with RDTSC-based anti-debug checks, which use the same clock-reading mechanism to detect single-step execution.
The third layer is privilege escalation through UAC bypass. Zenbox named UACMe alongside AveMaria in its sandbox verdict — UACMe is a well-documented open-source toolkit that exploits Windows User Account Control bypass techniques to elevate a process from medium to high integrity without triggering the standard UAC consent prompt [T1548.002]. Its presence in the sandbox verdict indicates the dropper either bundles UACMe components or downloads and executes them as part of the privilege-escalation sequence. This is not a subtle choice: UACMe is a named, catalogued tool that any mature EDR should flag on sight, which means its inclusion here implies either confidence that endpoint detection is absent or disabled on target systems, or that the dropper's evasion stack is expected to suppress EDR telemetry before UACMe executes.
The fourth layer is process injection [T1055]. T1055 is explicitly listed in the campaign's MITRE technique set, and Zenbox's Sigma analysis produced one critical and one high rule hit alongside two medium hits — a distribution consistent with process injection behaviour triggering high-confidence detection rules. AveMaria RAT is known to use process injection for in-memory execution, loading its core functionality into a host process to avoid leaving a standalone malicious binary resident on disk. The runtime-modules tag reinforces this: it indicates the dropper loads additional code modules dynamically at execution time rather than embedding them statically in the PE, consistent with reflective code loading [T1620], which is also present in the campaign's MITRE technique set.
The fifth layer is ICMP-based host discovery. Four Snort IDS rules fired during sandbox execution: PROTOCOL-ICMP Unusual PING detected (medium severity, category successful-recon-limited), PROTOCOL-ICMP PING Windows (low severity), PROTOCOL-ICMP PING (low severity), and PROTOCOL-ICMP Echo Reply (low severity). The successful-recon-limited category assigned to the first rule is significant — it indicates the sandbox's IDS engine interpreted the ICMP activity as reconnaissance rather than incidental connectivity testing. The operational logic is plausible: before committing to a C2 beacon, the dropper probes the network environment to confirm it is operating on a live host with real network connectivity, a check that would fail in isolated sandbox environments that block outbound ICMP.
Together, these five mechanisms — timing evasion, hardware-clock anti-debug, UAC bypass, process injection, and ICMP reconnaissance — constitute a layered evasion architecture that is more sophisticated than what a commodity RAT distributor would typically deploy. The combination suggests an operator who has invested in dropper development beyond simply repackaging a commercial RAT, or who has access to a dropper builder that incorporates these techniques as standard options.
The PE itself carries additional build-provenance signals. The file is a 668 KB Win32 PE32 GUI executable with a PE timestamp of 2022-09-15 — four days before its first VirusTotal submission on 2022-09-19, a gap consistent with a freshly compiled dropper submitted to VT shortly after build. The .text section registers entropy at 6.57 and the .data section at 6.82, both elevated but below the 7.5+ threshold typically associated with strong compression or encryption; the .rsrc section is comparatively low at 4.4, suggesting the resource section is not packed. The imphash is 6d02892187702a08a5e068f6251fc648 — notable primarily for its isolation: CTX Team's cross-IOC analysis found no shared imphash with any peer file in this campaign's indicator catalog, meaning no build-provenance clustering is possible from this axis alone. The vhash is 065056655d65156048z647zb09az18fz, and fuzzy hash (ssdeep) 12288:CKPN1P4g5optKjDPZvcdJ0JyRxGXxpnXeycupP0VHycN0vHL:nPcdJ0JyRSnN5 is available for similarity matching against future samples.
The Microsoft-Update Typosquat and Its Split Lifecycle
The domain msoftupdate.me is a textbook Microsoft-update typosquat: it drops the leading "o" from "Microsoft" and appends the low-cost .me TLD, producing a string that reads plausibly as an update-service hostname in a network traffic log without triggering the exact-match blocks that microsoft.com subdomains would. The remote. subdomain prefix reinforces the deception — it implies a remote-access or remote-management endpoint, consistent with how enterprise software legitimately labels RPC or management interfaces.
Both domains were registered on the same date, 2022-05-25, through NameCheap, Inc., with identical nameserver assignments (DNS101.REGISTRAR-SERVERS.COM and DNS102.REGISTRAR-SERVERS.COM) and WHOIS registrant country KZ. The organisation and state fields in the WHOIS record are not simply redacted — they are populated with hex-like strings (8158f4b848840d9f and a4d2ad5d9d67109a) that appear to be deliberate obfuscation rather than accidental data-entry artefacts. This pattern of using pseudo-random alphanumeric strings in WHOIS fields that nominally accept free-text organisation names is a recognised operational security practice among threat actors who want to avoid leaving reusable registration identifiers while still satisfying registrar form-validation requirements.
Three independent vendor categorisations confirm the parent domain's operational history: Sophos has categorised msoftupdate.me as command and control, Webroot as Bot Nets, and Forcepoint ThreatSeeker as malicious web sites. Despite this, the domain's VirusTotal detection ratio stands at only 6/91 — a low figure that reflects the domain's current parked status rather than its historical operational role. The subdomain remote.msoftupdate.me fares somewhat better at 13/91, with one community vote logged as malicious.
The current DNS state of msoftupdate.me tells a story of infrastructure lifecycle turnover. The WHOIS record carries four simultaneous status flags: clientTransferProhibited, pendingDelete, redemptionPeriod, and serverHold. The redemptionPeriod and pendingDelete statuses indicate the domain registration has lapsed and the registrar has not renewed it; serverHold means the registry has suspended DNS resolution. The last DNS records for the parent domain show a CNAME to 77980.bodis.com (resolving to 199.59.243.223) — a domain parking service that serves placeholder pages to expired domains. The operator has, in effect, lost or abandoned the parent domain.
What makes this operationally interesting is that remote.msoftupdate.me has not followed the same path. It continues to resolve to 45.79.244.209 via its own A record (TTL 304 seconds, indicating active management) and retains its TLS certificate record. The subdomain's DNS records also show CNAME entries to 878223.parkingcrew.net and 77980.bodis.com, suggesting some parking infrastructure is present, but the direct A record to 45.79.244.209 coexists with those CNAMEs. This architectural separation — where a subdomain can maintain independent resolution even after the parent domain's registration lapses — is not accidental. A subdomain's DNS records are managed at the authoritative nameserver level, not by the domain registrar's renewal status, meaning that as long as the nameservers (DNS101.REGISTRAR-SERVERS.COM) remain authoritative for the zone, the subdomain's A record can persist regardless of the parent domain's WHOIS status. The operator appears to have understood this: the subdomain was provisioned as the operational C2 endpoint from the outset, with the parent domain serving primarily as a namespace anchor.
The TLS certificate on remote.msoftupdate.me adds another layer to this picture. The certificate was issued by Let's Encrypt (issuer CN: R3, serial 3fc780329ba9c4348c8927d1a636c4368ed), valid from 2023-06-02 to 2023-08-31 — a lifespan of 89 days. Let's Encrypt's standard maximum certificate validity is 90 days, meaning this certificate was provisioned and allowed to expire within a single 90-day operational window. The 89-day span suggests the operator provisioned the certificate at the very start of a rotation cycle and either did not renew it or rotated to a new certificate after the window closed. Short-lived Let's Encrypt certificates are a well-established operational security practice among threat actors: they are free, require no identity verification, and rotate frequently enough to frustrate certificate-serial-based infrastructure tracking. The certificate's subject alternative name is remote.msoftupdate.me only — no additional SANs that would expose sibling infrastructure.
No ASN metadata was available for either resolved IP address (199.59.243.223 for the parked parent or 45.79.244.209 for the operational subdomain), which limits lateral pivot from the network layer. The absence of cross-certificate serial linkage to other infrastructure means the TLS certificate cannot be used to expand the known infrastructure footprint at this time.
Execution Flow: From Staging Directory to AveMaria RAT Channel
The dropper's meaningful name — %HOME%\unpack\new-.exe — and its alternate path references (%ALLUSERSPROFILE%:applicationdata, C:\ProgramData:ApplicationData) sketch the initial access and staging sequence. The \unpack\ directory path is consistent with a dropper that has been downloaded or extracted from an archive into a user-accessible staging location before execution [T1547] — a pattern common to phishing-delivered payloads where the initial attachment is a compressed archive that the user extracts manually. The C:\ProgramData path references suggest the dropper subsequently writes components to a system-accessible location that persists across user sessions, consistent with the runtime-modules tag indicating dynamic component installation.
Once executed, the dropper's first priority is evasion. The timing-based checks [T1497.003] and hardware-clock anti-debug routines [T1622] run before any network activity, ensuring the dropper aborts cleanly in sandboxed environments that cannot pass the timing checks. If those checks pass, the UAC bypass via UACMe [T1548.002] elevates the process to high integrity, enabling the subsequent persistence and injection steps that require elevated privileges.
Persistence is established through registry run-key or startup folder mechanisms [T1547.001]. T1547.001 is explicitly listed in the campaign's MITRE technique set, and the runtime-modules tag combined with the C:\ProgramData path references supports the inference that installed components are written to survive reboot. The campaign's MITRE set also includes T1070 (indicator removal) with sub-techniques T1070.004 (file deletion) and T1070.006 (timestomp), indicating the dropper performs post-execution cleanup — deleting staging artefacts and manipulating file timestamps to blend installed components with legitimate system files. Direct forensic evidence of specific file deletions or timestamp modifications is not present in the available sandbox telemetry, but the explicit MITRE listing is a reliable signal that these behaviours were observed in the analysis that produced the campaign metadata.
The ICMP reconnaissance phase — evidenced by the four Snort rule hits — appears to occur during or after the privilege-escalation sequence, before the C2 beacon is established. The PROTOCOL-ICMP Unusual PING detected rule at medium severity with category successful-recon-limited suggests the malware is probing network connectivity or performing host discovery rather than simply testing internet reachability. This is consistent with AveMaria RAT's operational model, which benefits from understanding the network environment before committing to a persistent C2 channel.
The C2 channel itself resolves to remote.msoftupdate.me at 45.79.244.209, encrypted under the Let's Encrypt R3 certificate [T1071]. The AveMaria RAT family — confirmed by Zenbox's sandbox verdict — is a full-featured remote-access trojan with credential harvesting, keylogging, webcam access, and remote shell capabilities. Zenbox's co-classification of the sample as PHISHING alongside TROJAN is consistent with AveMaria's credential-harvesting focus: the RAT is frequently deployed in campaigns where the ultimate objective is the theft of stored credentials from browsers, email clients, and VPN software. The spreader tag and the popular name streamer suggest the dropper does not embed the AveMaria implant statically but rather streams or downloads it as a secondary payload after initial execution — a staged delivery model [T1620] that keeps the full implant off disk until the evasion checks have passed and the environment has been confirmed as a live target.
The collection and exfiltration stage — credential and data harvesting consistent with AveMaria's capability set — is inferred from the payload family identification and the campaign's attributed espionage motivation. Direct evidence of exfiltrated data is not available from the sandbox run.
Detection Coverage and the Opaque Second Hash
At 62/77 engines flagging the primary dropper, the detection picture looks strong in aggregate — but the distribution matters. Fifteen engines still miss the sample, including several with broad enterprise deployment footprints. The Sigma analysis produced one critical and one high rule hit from the Sigma Integrated Rule Set, alongside one critical hit from the Joe Security Rule Set — a combined four Sigma matches that confirm the sample's behaviour is within the detection envelope of well-maintained rule sets. The IDS rule hits (PROTOCOL-ICMP Unusual PING detected, PROTOCOL-ICMP PING Windows, PROTOCOL-ICMP PING, PROTOCOL-ICMP Echo Reply) provide network-layer detection opportunities that complement endpoint-based coverage.
The more significant analytical gap in this update is the second file hash: c3e90c40b6c0865ab614b4d5999fe48f2417fdb123348ac717a0f25a23ff28da. This SHA-256 appears in the campaign's indicator catalog as a confirmed campaign-associated file, but carries no VirusTotal metadata whatsoever — no file type, no detection ratio, no submission date, no tags. It is entirely opaque to analysis at this time. CTX Team cannot determine its file type, build provenance, behavioural profile, or relationship to the primary dropper. The absence of any VT metadata could indicate the file has never been submitted to VirusTotal, that it was submitted under strict privacy settings, or that it represents a component that exists only in memory or in a form that VT's processing pipeline cannot parse. Whatever the explanation, the analytical implication is the same: this is a blind spot in the current evidence picture, and the file's role in the campaign's execution chain — whether it is a second-stage payload, a configuration file, a UACMe component, or something else entirely — cannot be determined from available telemetry.
The primary dropper is also isolated from a build-provenance perspective: no shared imphash, signer, or threat label links it to any peer file in the indicator catalog. The imphash 6d02892187702a08a5e068f6251fc648 does not cluster with any other known sample in this campaign, which limits the ability to identify sibling droppers or track the builder across campaigns. The file carries no code-signing certificate — it is unsigned — which removes the certificate-serial linkage axis that often provides the most durable cross-campaign tracking signal.
The domain-side coverage is comparatively thin: msoftupdate.me at 6/91 and remote.msoftupdate.me at 13/91 reflect the low detection rates typical of infrastructure IOCs that are not embedded in malware samples widely circulated through VT. The three vendor categorisations of the parent domain (Sophos: command and control; Webroot: Bot Nets; Forcepoint ThreatSeeker: malicious web sites) are the most operationally useful domain-side signals, as they represent active threat-intelligence categorisations rather than file-hash-derived detections.
YoroTrooper, AveMaria, and the WarzoneRAT Lineage
YoroTrooper is attributed to this campaign, with espionage listed as the operative motivation and ave_maria as the confirmed payload family. The WHOIS registrant country KZ on both C2 domains is consistent with YoroTrooper's previously reported Central Asian operational nexus, though WHOIS registrant country alone is not definitive attribution evidence — it is one data point among several that collectively support the attribution at medium confidence.
The relationship between this update and the prior WarzoneRAT coverage (CTXhr7pm5yetf) warrants a brief technical note. WarzoneRAT and AveMaria are closely related RAT families: WarzoneRAT is widely understood to be a commercial rebranding or evolution of AveMaria, sharing significant code lineage and capability overlap. The shift from WarzoneRAT in the prior cluster to AveMaria in this update may represent payload rebranding, version rotation, or simply a different build of the same underlying codebase rather than a wholesale tooling change. The meaningful evolution between the two clusters — sitting on top of the same infrastructure backbone — is consistent with an operator refreshing payload builds within an established operational envelope rather than standing up an entirely new campaign.
No historical arc claims for this actor are documented in the current brief, and no widely-reported prior campaign with confident public attribution comes to mind for this specific cluster. Claims about YoroTrooper's broader campaign history would require additional public reporting, and CTX Team will not speculate beyond the evidence.
Infrastructure Lifecycle Anomalies and What They Signal About Operational Maturity
The split lifecycle of the msoftupdate.me domain pair is the most analytically distinctive feature of this campaign's infrastructure, and it points toward a specific operational design philosophy rather than accidental circumstance.
Most threat actors who register a parent domain and a subdomain for C2 purposes treat them as a unit: when the parent domain is abandoned or seized, the subdomain goes with it. The msoftupdate.me / remote.msoftupdate.me pair behaves differently. The operator registered both on the same date through the same registrar with the same nameservers, establishing a unified infrastructure footprint. But the C2 function was placed exclusively on the subdomain — remote.msoftupdate.me at 45.79.244.209 — while the parent domain served as a namespace anchor with no apparent independent C2 role. When the parent domain's registration lapsed and entered redemption and pendingDelete status, the subdomain's A record continued to resolve because subdomain DNS is managed at the authoritative nameserver level, not by the registrar's renewal status. The operator either understood this DNS architecture and exploited it deliberately, or stumbled into resilience by accident. Given the sophistication of the dropper's evasion stack, deliberate design seems the more plausible inference.
This architectural pattern has a practical implication for infrastructure tracking: takedown efforts that target the parent domain registration — the standard approach for domain-based C2 disruption — will not necessarily affect subdomain resolution if the authoritative nameservers remain operational. A more complete takedown would require either seizure of the nameserver records or direct action against the IP address 45.79.244.209. The absence of ASN metadata for that IP means CTX Team cannot identify the hosting provider or assess the feasibility of abuse-report-based takedown.
The 89-day Let's Encrypt certificate rotation window provides a predictable infrastructure refresh signal. Let's Encrypt certificates are issued in 90-day windows and must be renewed before expiry; an operator who provisions a certificate at the start of a window and allows it to expire without renewal will generate a new certificate issuance event approximately every 90 days. Monitoring for new Let's Encrypt certificate issuances to remote.msoftupdate.me as the subject CN — or to any new subdomain under the msoftupdate.me namespace if the parent domain is re-registered — would provide advance warning of infrastructure reactivation.
The introduction of two new file hashes with one entirely opaque to VirusTotal analysis, combined with the meaningful shift from the prior WarzoneRAT cluster, indicates active payload rotation within the YoroTrooper operational envelope. The five-layer anti-analysis stack — particularly the combination of UACMe, timing evasion, hardware-clock anti-debug, and ICMP-based host discovery — represents a dropper architecture that has demonstrably evaded 15 of 77 AV engines at time of analysis. The operator is not simply reusing commodity tools unchanged; the dropper's evasion mechanisms show investment in detection avoidance that goes beyond what a standard AveMaria RAT deployment would require.
What this pattern signals at the campaign level is an actor operating with a degree of operational security discipline that is consistent with state-aligned espionage objectives: deliberate WHOIS obfuscation, subdomain-isolated C2 architecture, short-rotation TLS certificates, a multi-layer evasion stack tuned against sandbox detection, and payload staging that keeps the full implant off disk until the environment has been validated. The organisations most likely to encounter this cluster — government, diplomatic, and energy-sector targets in Central Asia and adjacent regions, based on YoroTrooper's attributed focus and the Kazakhstan-geolocated infrastructure — are facing an adversary who has invested meaningfully in staying below the detection threshold of standard enterprise security tooling. The opaque second file hash is a reminder that the visible portion of any active campaign's toolset is rarely the complete picture.