Keypoints
- Initial vector: spearphishing email with a malicious .html attachment (PO-2200934-KINQTE.html).
- The HTML contains scripts and a large base64 blob that decodes to a RAR archive (PO-2200934-KINQTE.rar).
- The RAR contains PO-2200934-KINQTE.exe, identified as DBatLoader (hash bdb74765f6e99f2af997bb1916e373390aafa21100f8638c4d4dc89553fbba35).
- DBatLoader retrieves an encrypted payload hosted on OneDrive (download link present in sample).
- Decryption of the downloaded payload yields WarZone RAT (hash 4c014a78f07a12a659b780d0da285a897a7ff56234796da909dc7a172e9282fc).
- Recovered C2 configuration for WarZone RAT: halal.home-webserver.de:3109.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – Delivery via an email with “an attached .html file” used to trick the user into opening the malicious content (‘an attached .html file’).
- [T1204] User Execution – The attack relies on user action to open the HTML in a browser, causing embedded scripts to run (‘open the .html file through popular browsers such as Edge or Chrome’).
- [T1059] Scripting – Embedded scripts in the HTML perform decoding and write the RAR/executable to disk (‘contains scripts and a large blob of base64-encoded data’).
- [T1027] Obfuscated Files or Information – Use of base64 encoding within the HTML to hide the payload (‘base64-encoded data’).
- [T1036] Masquerading – The script simulates downloading a benign RAR file to disguise the executable (‘simulate downloading the file PO-2200934-KINQTE.rar’).
- [T1105] Ingress Tool Transfer – DBatLoader downloads an encrypted stage from a public cloud service (OneDrive) to deliver the WarZone RAT (‘it will load the payload from OneDrive’).
- [T1071] Application Layer Protocol – The loader and RAT use standard application-layer channels to communicate with remote resources (download and C2 communication noted in analysis) (‘DBatLoader typically performs download … from public cloud services’).
- [T1001] Data Obfuscation – The payload is encrypted/obfuscated while hosted on cloud storage to hinder detection (‘encrypted payload is still downloadable via the link above’).
- [T1041] Exfiltration Over C2 Channel – WarZone RAT establishes a C2 channel that can be used to exfiltrate data (‘extracting the C2 information that the WarZone RAT payload will connect to’).
- [T1005] Data from Local System – RATs like WarZone typically collect sensitive host data for exfiltration (implied post-compromise behavior) (‘WarZone RAT may gather sensitive information from the host system’).
Indicators of Compromise
- [Filename] Email attachment / extracted files – PO-2200934-KINQTE.html, PO-2200934-KINQTE.exe
- [File hash] Sample hashes – 7b51aaf3071c6f0dad3865e0fa9cc19d2be45a46dbe507b9254ca6d7ba01d850 (PO-2200934-KINQTE.html), bdb74765f6e99f2af997bb1916e373390aafa21100f8638c4d4dc89553fbba35 (DBatLoader)
- [Download URL] Encrypted payload location – hxxps://onedrive[.]live[.]com/download?resid=FDB0512DE793B32E%21180&authkey=!AHbZUypgd3P08kc
- [File hash] WarZone RAT binary – 4c014a78f07a12a659b780d0da285a897a7ff56234796da909dc7a172e9282fc
- [Domain:Port] Command-and-control endpoint – halal[.]home-webserver[.]de:3109
The technical chain begins when the emailed HTML attachment is opened: embedded JavaScript contains a base64 blob which is decoded into a RAR archive and extracted to yield PO-2200934-KINQTE.exe. Static inspection and hash checks identify that executable as DBatLoader (bdb74765…), and the HTML script deliberately presents the payload as a .rar to evade casual inspection and mimic benign downloads.
DBatLoader’s runtime behavior downloads an encrypted stage from a OneDrive download URL embedded in the sample; analysts retrieved that encrypted payload and decrypted it to reveal a WarZone RAT binary (4c014a78…). String and configuration extraction routines (reused from prior WarZone analysis) were applied to recover embedded C2 settings.
Outcome: the pipeline is straightforward—phishing HTML → base64 decode → RAR → DBatLoader executable → cloud-hosted encrypted payload → decrypted WarZone RAT → C2 connection to halal.home-webserver.de:3109. Relevant IOCs (filenames, hashes, OneDrive URL, and C2 domain:port) are provided above for detection and blocking.