WarzoneRAT Invoice Lure Layers Anti-Analysis Stack Against Turkish Targets
A commercially packed AveMaria UACMe variant deployed under invoice-themed filenames combines timing-based sandbox evasion, RDTSC debugger detection, reflective loading, and UAC bypass to target Turkish organisations. The implant beacons over TLS to a Microsoft-mimicking domain pair registered in a single NameCheap session under obfuscated Kazakhstan-linked tokens, and still evades 17 of 77 detection engines as of mid-2025.
Invoice Lure Conceals a Layered Anti-Analysis Engine Aimed at Turkish Targets
A 2,695-kilobyte Windows executable, packaged under the filename Invoice.exe and built inside a commercial crypter environment, carries one of the more deliberately constructed anti-analysis stacks CTX Team has documented in a commodity remote-access trojan deployment: timing-based sandbox evasion, debugger detection, reflective code loading, process injection, UAC bypass, and an aggressive indicator-removal suite — all wrapped in a TLS-encrypted C2 channel that hides behind a hostname engineered to look like a Microsoft update endpoint. The payload is the AveMaria UACMe variant of WarzoneRAT, and the infrastructure that supports it was provisioned in a single registration session under obfuscated registrant tokens linked to Kazakhstan, via NameCheap, on 25 May 2022. The combination is operationally significant not because WarzoneRAT is novel — it is not — but because the layering of these techniques around a commodity implant produced a package that partially defeated sandbox analysis and still registers a 55/77 detection ratio as of mid-2025, suggesting meaningful dwell potential against organisations that depend on a single detection layer.
The threat feed attributes this cluster to Gold Evergreen (also tracked as Business Club), with espionage listed as the stated motivation and Turkey as the targeted region. CTX Team assessed this campaign at severity 57, confidence 85.
A Commercial Crypter, a UAC-Bypass Variant, and a Build Path That Tells the Story
The most direct evidence of how this payload was constructed sits inside the binary's own alternate-name artefacts. Alongside the operational filename psmzx.exe, the sample carries the paths /Volumes/Warzone Crypter(1)/Invoice.exe, %HOME%\unpack\Invoice_new.exe, and %HOME%\unpack\Profoma.exe — the last almost certainly a misspelling of "Proforma", consistent with a non-native-English operator assembling business-document lures. The /Volumes/Warzone Crypter(1)/ prefix is a direct build-environment artefact: it places the packing operation inside a commercially available Warzone Crypter instance, a service-model crypter that provides obfuscation and packing as a purchasable capability, lowering the technical barrier for operators who want to harden a commodity RAT without writing their own obfuscation layer.
The binary itself is a PE32 executable for MS Windows (Intel 80386, GUI subsystem), compiled on 12 June 2022 and first submitted to VirusTotal on 14 June 2022 — a two-day gap between compilation and first external observation that is consistent with a short pre-deployment testing window. It is unsigned, which is notable given that T1553 (Subvert Trust Controls) appears in the MITRE profile. The operator's trust-control subversion strategy here appears to rely on the crypter's obfuscation and the UAC bypass rather than on a code-signing certificate — a choice that trades the EDR-allowlist benefit of a signed binary for the operational simplicity of not having to acquire or abuse a certificate.
The packer is identified by PEiD. Section-level entropy tells a nuanced story: the .text section (960 KB) sits at entropy 5.41 and the .reloc section at 5.87 — moderate figures that do not immediately scream high-compression packing — while the .data section (1,470 KB, the largest by far) registers entropy of only 1.99, consistent with a large block of initialised but largely zeroed data rather than encrypted payload. The .rdata section at 3.74 and .idata at 4.83 are similarly unremarkable. The import count is zero, which is itself a packing artefact: a packed binary that resolves its imports dynamically at runtime will show an empty static import table, defeating import-hash-based static detection. The imphash for this sample is 83d8b9eab153aa33153d529042516ec9; no peer file in the current catalog shares this imphash, so it cannot serve as a cross-campaign pivot, though it remains a stable hunting anchor for future submissions.
The Zenbox sandbox names the family AveMaria UACMe with 88% confidence, identifying this specifically as the UAC-bypass variant of WarzoneRAT. The UACMe designation refers to integration of the UACMe toolkit, which exploits weaknesses in Windows User Account Control to escalate privileges without triggering the standard UAC elevation prompt [T1548.002 is the broader technique family; the MITRE profile here carries T1553.005 as the trust-control subversion angle]. This variant is more capable than a standard WarzoneRAT deployment: privilege escalation without a visible UAC dialog removes a detection opportunity that endpoint products and trained users might otherwise catch.
Timing Tricks and a Clean Verdict: How One Sandbox Was Fooled
The anti-analysis architecture layered into this sample is where the operational investment becomes visible. Four sandbox environments processed the binary; three returned malicious verdicts — Zenbox (88% confidence, classifying the sample as MALWARE, STEALER, PHISHING, TROJAN, and EVADER), Dr.Web vxCube, and ReaQta-Hive — while one, DAS-Security Orcas, returned a CLEAN verdict. That split is not random noise. The sample carries two tags that directly explain it: long-sleeps and direct-cpu-clock-access.
Long-sleeps is the operational signature of time-based sandbox evasion [T1497.003]: the implant inserts extended sleep calls — often measured in minutes rather than seconds — that cause automated sandbox environments with fixed analysis windows to time out before the malicious payload executes. Many sandboxes accelerate the system clock to compensate, which is where the second tag becomes relevant. Direct-cpu-clock-access refers to RDTSC-based timing checks [T1622]: the implant reads the CPU's timestamp counter directly, bypassing the operating system's clock API. Because the RDTSC instruction reflects actual hardware cycles rather than the virtualised clock, a sandbox that accelerates wall-clock time cannot fool an RDTSC check — the discrepancy between the hardware cycle count and the expected elapsed time exposes the analysis environment. The combination of these two techniques — sleeping long enough to exhaust sandboxes that don't accelerate, and using RDTSC to detect those that do — creates a two-layer evasion that is effective against a meaningful fraction of automated analysis infrastructure.
The Sigma rule set recorded one critical hit and two high hits against this sample from the Sigma Integrated Rule Set (GitHub), alongside one critical hit from the Joe Security Rule Set. The critical Sigma hit is consistent with registry manipulation or log-clearing behaviour, aligning with the T1070 family of indicator-removal techniques that appear in the MITRE profile: T1070.004 (file deletion), T1070.006 (timestomping), and T1070.010 (additional artefact clearing). Timestomping [T1070.006] modifies the $STANDARD_INFORMATION attribute of files to make newly dropped artefacts appear to have existed for months, blending them with legitimate system files. File deletion [T1070.004] removes staging artefacts after unpacking. Together, these techniques are applied after execution to reduce the forensic footprint available to incident responders — a post-execution cleanup pass that complements the pre-execution sandbox evasion.
Process injection [T1055] and reflective code loading [T1620] round out the evasion stack. Reflective loading allocates and executes payload modules directly within the process's memory space, without writing a file to disk that would be backed by a filesystem path — the loaded code exists only in RAM, defeating file-based detection. Process injection then moves execution into the address space of a legitimate host process, masking the implant's activity under a process name that endpoint products are less likely to flag. The Zenbox classification of the sample as EVADER is consistent with this combination: the sandbox observed the binary actively working to conceal its execution context.
Registry run-key persistence [T1547.001] and registry modification [T1112] are both present in the MITRE profile, indicating the implant writes itself to a standard autostart location to survive reboots. The T1564 family (Hide Artifacts, including T1564.001 and T1564.004) suggests additional steps to conceal the persistence mechanism itself — hidden files or alternate data streams that make the autostart entry less visible to casual inspection. The alt-name C:\ProgramData:ApplicationData in the dossier is consistent with alternate data stream usage [T1564.004], where a payload is stored in an ADS attached to a legitimate directory rather than as a standalone file.
The net result is a sample that, as of mid-2025, is flagged by 55 of 77 engines — a detection ratio that leaves 17 engines returning undetected and four unable to process the file type. Notable misses include APEX, SentinelOne, Trapmine, and Gridinsoft. The community vote stands at one malicious, zero harmless, and the reputation score is -52, reflecting a file that the security community has collectively assessed as hostile even where individual engines have not yet caught up.
The C2 Infrastructure: A Microsoft-Mimicking Domain Pair Built in a Single Session
The infrastructure supporting this campaign was provisioned as a deliberate unit. On 25 May 2022, a single operator registered both msoftupdate.me and its subdomain remote.msoftupdate.me through NameCheap, Inc. (IANA registrar ID 1068) in what the cohort analysis identifies as a single registration session. The binding evidence is precise: both domains share identical obfuscated WHOIS registrant organisation tokens (8158f4b848840d9f), identical obfuscated state strings (a4d2ad5d9d67109a), a registrant country of Kazakhstan (KZ) — an unverified, self-declared value in an anonymised registration — and the same authoritative nameservers, DNS101.REGISTRAR-SERVERS.COM and DNS102.REGISTRAR-SERVERS.COM. This is not two independently acquired domains that later converged on the same infrastructure; it is a pre-planned C2 build-out where the apex and the active endpoint were registered together, under the same anonymised identity, before the payload was compiled.
The domain label itself is the first layer of masquerade [T1036]: msoftupdate.me is visually plausible as a Microsoft update endpoint to a network reviewer doing a quick scan of outbound connections. The .me TLD is the only tell — Microsoft's actual update infrastructure uses .com and .microsoft.com — but under time pressure or without a reference list, the hostname passes casual inspection. The subdomain remote.msoftupdate.me extends the illusion: a "remote" update endpoint is a plausible label for a Microsoft distribution node.
The two domains played asymmetric operational roles. remote.msoftupdate.me was the active C2 node. It resolved to 45.79.244.209 and held a Let's Encrypt TLS certificate issued by the R3 intermediate CA (serial 3fc780329ba9c4348c8927d1a636c4368ed), valid from 2 June 2023 to 31 August 2023 — an 89-day window, consistent with Let's Encrypt's standard 90-day certificate lifecycle. The certificate covers only remote.msoftupdate.me as its sole subject alternative name, indicating it was provisioned specifically for this endpoint rather than as part of a broader wildcard or multi-domain certificate. The short validity window is a cert anomaly worth noting: a certificate burned for a single 89-day operational window and then allowed to expire is consistent with an operator who treats TLS certificates as disposable operational assets rather than long-term infrastructure investments. The HTTPS channel this certificate enabled [T1071.001] provided encrypted cover for C2 beaconing, making the traffic indistinguishable from legitimate HTTPS at the network layer without deep packet inspection or certificate pinning.
The Snort IDS rule MALWARE-CNC Win.Trojan.AveMaria variant outbound connection (alert severity: high, Snort registered user ruleset) fired against the sample's network traffic, confirming C2 beaconing behaviour directed at this infrastructure. A secondary Snort hit, PROTOCOL-ICMP Unusual PING detected (alert severity: medium), suggests the implant also conducted ICMP-based network reconnaissance, consistent with AveMaria's documented host-enumeration capability. The direct file-to-domain resolution chain — confirming that this specific binary beaconed to this specific IP — is assessed as strong-inference rather than directly observed network telemetry.
The apex domain msoftupdate.me tells a different story. It carries only 6 of 91 detections, holds no TLS certificate on record, and currently resolves to 199.59.243.223 via a 77980.bodis.com CNAME — a domain parking service. This pattern is consistent with the apex having served as a registration anchor or dormant fallback rather than an active C2 endpoint: the operator registered it to establish the namespace, pointed the active traffic to the subdomain, and never operationalised the apex itself. Both domains are now in redemptionPeriod and pendingDelete status with serverHold applied, indicating the operator has not renewed them and the infrastructure has been abandoned. The operational lifecycle — registration in May 2022, active C2 certificate window June–August 2023, current abandonment — suggests a campaign that ran for roughly a year before the operator rotated away from this specific infrastructure set.
The C2 IP 45.79.244.209 has no ASN attribution available, which limits pivot analysis on the hosting provider and prevents assessment of whether the operator has a pattern of concentrating infrastructure in a particular autonomous system.
WarzoneRAT's Capability Stack: From Credential Harvest to Remote Shell
WarzoneRAT — also catalogued as Ave Maria or AveMaria — is a commercially available remote-access trojan that has circulated since at least 2018. The AveMaria UACMe variant identified here by Zenbox represents a capability-enhanced build that integrates privilege escalation directly into the implant's execution flow, removing the need for a separate post-exploitation step to gain elevated access.
The Zenbox classification of this sample as STEALER, PHISHING, TROJAN, and EVADER maps directly to AveMaria's documented capability set. The STEALER classification indicates credential-harvesting modules: AveMaria is known to target browser-stored passwords across major browsers, email client credentials, and in some configurations webcam data. The PHISHING classification likely reflects the implant's ability to intercept or inject into browser sessions rather than a standalone phishing capability. The TROJAN and EVADER classifications reflect the RAT's remote-shell and anti-analysis functions respectively. The spreader tag in the VT indicator catalog suggests the sample may also attempt lateral propagation, though current evidence is too thin to conclude that beyond the tag itself.
The credential-harvesting capability [T1555] is the action-on-objectives most consistent with the espionage motivation recorded in the threat feed. An operator targeting Turkish organisations for intelligence collection would use AveMaria's stealer modules to harvest email credentials, VPN passwords, and browser-stored authentication tokens — data that enables persistent access to organisational communications and systems without requiring a separate implant for each target. The remote-shell capability provides the operator with interactive access for manual reconnaissance and lateral movement once initial credentials are obtained.
The binary is unsigned, which creates a detection opportunity that the operator compensates for through the crypter's obfuscation and the UAC bypass. The T1553 MITRE tag in the profile — Subvert Trust Controls — reflects this: rather than acquiring a legitimate or stolen code-signing certificate to pass allowlist checks, the operator relies on the crypter to defeat static analysis and the UAC bypass to defeat privilege-based controls. This is a pragmatic trade-off: code-signing certificates that survive EDR scrutiny are increasingly difficult and expensive to obtain, while commercial crypters are available for a fraction of the cost and can be re-purchased or re-configured when their signatures are burned.
The invoice-themed delivery filenames — Invoice.exe, Invoice_new.exe, and Profoma.exe — establish the initial-access vector as spear-phishing attachment [T1566.001], almost certainly targeting finance or procurement personnel who routinely handle proforma invoice documents. The misspelling "Profoma" for "Proforma" is a minor operational tell: it is consistent with a non-native-English speaker assembling lure filenames without a native-language review pass. Whether this reflects the operator's own language background or a deliberate choice to introduce a plausible typo is not determinable from the artefacts alone.
Gold Evergreen's Operational Fingerprint in This Cluster
The threat feed attributes this campaign to Gold Evergreen, also tracked under the alias Business Club, with espionage as the stated motivation and Turkey as the targeted region. CTX Team records this attribution at confidence 85. Beyond the threat feed's actor assignment, no prior named campaigns or external reporting on this specific cluster appear in the public evidence set. The honest assessment is that the available artefacts — one file, two domains, no IP ASN attribution, no code-signing certificate — limit the attribution confidence that can be derived independently. The commercially available crypter and commodity RAT reduce the uniqueness of the binary fingerprint, and the obfuscated WHOIS registrant tokens prevent direct operator identification.
What the infrastructure pattern does establish is a consistent operational signature: a single operator who pre-registers an apex domain and its active C2 subdomain in a single NameCheap session under anonymised KZ-linked registrant tokens, provisions a short-lived Let's Encrypt certificate on the active subdomain, and deploys a commercially packed AveMaria variant under invoice-themed filenames against Turkish targets for espionage purposes. Whether this pattern recurs under different domain labels remains an open question, but the template itself — apex-plus-subdomain pair, same-day registration, obfuscated registrant, short-lived cert — is specific enough to serve as a detection hypothesis for future infrastructure provisioning by the same operator.
The use of commodity tooling — a purchasable crypter, a commercially available RAT, a free TLS certificate from Let's Encrypt — is consistent with an actor who prioritises operational speed and cost efficiency over custom capability development. This is an inference from the tooling choices rather than a confirmed capability assessment: the possibility that Gold Evergreen also operates bespoke tooling in parallel, using commodity tools for lower-priority or higher-volume targeting, cannot be ruled out.
What a Partially Successful Sandbox Evasion Signals About Commodity Threat Maturity
The most analytically significant aspect of this cluster is not the malware family — WarzoneRAT is well-catalogued and widely detected — but the deliberate investment in anti-analysis architecture around a commodity implant. The operator did not build a novel RAT; they took an existing commercial tool, ran it through a commercial crypter, integrated a UAC bypass variant, layered in timing-based sandbox evasion and RDTSC-based debugger detection, and wrapped the C2 channel in a TLS certificate on a Microsoft-mimicking hostname. Each individual component is available commercially or as open-source tooling. The sophistication lies in the assembly.
The result is a package that partially defeated automated sandbox analysis in 2022–2023 — one of four sandboxes returned clean — and that still registers 17 undetected engines as of mid-2025. For organisations in Turkey that rely on a single detection layer, whether that is a perimeter sandbox, an endpoint agent, or a network IDS, this payload has a meaningful probability of passing undetected through at least one of those layers. The Snort rule MALWARE-CNC Win.Trojan.AveMaria variant outbound connection provides a network-layer detection anchor, but only for environments running the Snort registered user ruleset and monitoring outbound TLS traffic at the rule-match level.
The infrastructure lifecycle adds a further operational dimension. The operator provisioned the C2 infrastructure three weeks before the payload was compiled, suggesting pre-campaign infrastructure build-out rather than reactive domain registration. The 89-day Let's Encrypt certificate on the active subdomain was allowed to expire without renewal, and both domains are now in redemptionPeriod — the operator has moved on. But the registration pattern itself is replicable: a NameCheap account, an obfuscated registrant identity, a .me TLD with a Microsoft-adjacent label, and a free Let's Encrypt certificate represent a C2 provisioning template that costs under fifty dollars and takes under an hour to replicate under a different domain label.
The sector that will feel this shift most acutely is the mid-tier Turkish private sector — organisations large enough to hold intelligence value for an espionage-motivated actor but without the mature endpoint detection and network monitoring infrastructure of a major enterprise. Finance and procurement functions, the implied target of invoice-lure phishing, are particularly exposed: the lure is contextually plausible, the payload is capable, and the anti-analysis stack is tuned to defeat the automated detection layers that smaller organisations are most likely to rely on. The broader signal is that the commoditisation of anti-analysis techniques — timing evasion, RDTSC checks, reflective loading, UAC bypass — has reached the point where these capabilities are available as purchasable add-ons to a commodity RAT deployment, not as markers of a sophisticated state-sponsored actor. The barrier to assembling this kind of layered evasion stack is now primarily financial rather than technical, and it is low.