S0670 - WarzoneRAT

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.

Author
agomez
Created
2023-06-13 23:47:01
Last updated
2026-02-07 18:39:15
Downloads
396246
Sample indicators
39

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

45.138.16.214 IPv4

modified 2026-10-17 11:11:02
Mail Spammer (Abuseat.org) · Ave Maria (ThreatFox Abuse.ch) · Suspicious Host (AbuseIPDB) · HTTP bot (Blocklist.de) · DDoS Attacker (AbuseIPDB)

37.120.155.179 IPv4

modified 2026-10-17 11:08:08
Ave Maria (ThreatFox Abuse.ch) · Remcos (ThreatFox Abuse.ch) · HTTP Spammer (Sblam) · ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic (Emerging Threats) · Proxy (IPWhois.io)

SWIFT-Payment Receipt-XXXXX9622_RUGL1_R1110163-18070221620076007.exe Sample

modified 2026-10-17 10:25:33
AveMariaRAT (MalwareBazaar Abuse.ch)

asdfwrkhl.warzonedns.com Hostname

modified 2026-10-17 09:33:25
Ave Maria (ThreatFox Abuse.ch)

lesbianporn.duckdns.org Hostname

modified 2026-10-17 08:40:51
Ave Maria (ThreatFox Abuse.ch)

dubem2021.duckdns.org Hostname

modified 2026-10-17 08:40:33
Ave Maria (ThreatFox Abuse.ch)

testing1212.ddns.net Hostname

modified 2026-10-17 08:39:26
Ave Maria (ThreatFox Abuse.ch)

jude77.duckdns.org Hostname

modified 2026-10-17 08:38:41
Ave Maria (ThreatFox Abuse.ch)

eazeeflo.warzonedns.com Hostname

modified 2026-10-17 08:38:33
Ave Maria (ThreatFox Abuse.ch) · Generic.Malware (Hybrid-Analysis)

meeti.hopto.org Hostname

modified 2026-10-17 08:38:32
Ave Maria (ThreatFox Abuse.ch)

126e6797c0ad426bdac8aef9ff8a540c6c0ae91c9be091a6cc02f9cf1138d92e Sample

modified 2026-10-17 07:38:52
Warzone (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

minekroft.duckdns.org Hostname

modified 2026-10-17 04:39:22
Ave Maria (ThreatFox Abuse.ch) · Malware.Generic (Hybrid-Analysis) · PE (Hybrid-Analysis)

l34d3r.duckdns.org Hostname

modified 2026-10-17 04:37:11
Ave Maria (ThreatFox Abuse.ch)

esureforme100.myddns.rocks Hostname

modified 2026-10-17 04:35:21
Ave Maria (ThreatFox Abuse.ch)

desireblex.ddns.net Hostname

modified 2026-10-17 04:34:54
Ave Maria (ThreatFox Abuse.ch)

badnulls.warzonedns.com Hostname

modified 2026-10-17 04:34:54
Ave Maria (ThreatFox Abuse.ch)

engrs.warzonedns.com Hostname

modified 2026-10-17 04:34:05
Ave Maria (ThreatFox Abuse.ch)

yulanda.hopto.org Hostname

modified 2026-10-17 04:09:50
Ave Maria (ThreatFox Abuse.ch)

thebeast415.duckdns.org Hostname

modified 2026-10-17 02:32:08
Ave Maria (ThreatFox Abuse.ch)

a244d64dcadd2bfa5bfd682d198c4db0a890137b64e7c82ad47ee7a994d2d57f Sample

modified 2026-10-17 01:10:46
Warzone (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

crypted.ps1 Sample

modified 2026-10-17 00:59:58
Warzonerat (Triage)

warzonlogs.duckdns.org Hostname

modified 2026-10-17 00:40:17
Ave Maria (ThreatFox Abuse.ch)

smilecat.ddns.net Hostname

modified 2026-10-17 00:40:13
DeepScan:Generic.Malware.SLlg (Hybrid-Analysis) · Ave Maria (ThreatFox Abuse.ch)

54369253290033.sytes.net Hostname

modified 2026-10-17 00:39:50
Ave Maria (ThreatFox Abuse.ch) · Trojan.Generic (Hybrid-Analysis) · DangerousObject.Multi (Hybrid-Analysis)

caebd.ddns.net Hostname

modified 2026-10-17 00:38:52
Ave Maria (ThreatFox Abuse.ch)

afair.ddns.net Hostname

modified 2026-10-17 00:38:02
Ave Maria (ThreatFox Abuse.ch)

chefdnshot.ddns.net Hostname

modified 2026-10-17 00:37:20
Ave Maria (ThreatFox Abuse.ch)

dnst.warzonedns.com Hostname

modified 2026-10-17 00:36:57
Ave Maria (ThreatFox Abuse.ch)

oficina3030.duckdns.org Hostname

modified 2026-10-17 00:36:20
Ave Maria (ThreatFox Abuse.ch)

pubg.ddns.net Hostname

modified 2026-10-17 00:36:19
Ave Maria (ThreatFox Abuse.ch)

nan.ydns.eu Hostname

modified 2026-10-17 00:36:16
Ave Maria (ThreatFox Abuse.ch)

bossnew.ddns.net Hostname

modified 2026-10-17 00:35:17
Ave Maria (ThreatFox Abuse.ch)

soon-lp.at.ply.gg Hostname

modified 2026-10-17 00:34:07
Remcos (ThreatFox Abuse.ch) · Ave Maria (ThreatFox Abuse.ch) · XWorm (ThreatFox Abuse.ch) · NjRAT (ThreatFox Abuse.ch)

217.151.98.163 IPv4

modified 2026-10-16 22:19:22
Bruteforce login attacker (Blocklist.de) · HTTP Attacker (Blocklist.de) · Remcos (ThreatFox Abuse.ch) · HTTP Spammer (StopForumSpam.com) · IMAP Attacker (Blocklist.de)

pliblu-fax.home-webserver.de Hostname

modified 2026-10-16 20:57:53
Ave Maria (ThreatFox Abuse.ch)

urchy.duckdns.org Hostname

modified 2026-10-16 20:40:33
Ave Maria (ThreatFox Abuse.ch)

thedonaldman77.warzonedns.com Hostname

modified 2026-10-16 20:40:15
Ave Maria (ThreatFox Abuse.ch) · DeepScan:Generic.Malware.SLlg (Hybrid-Analysis)

wealth.warzonedns.com Hostname

modified 2026-10-16 20:38:43
Ave Maria (ThreatFox Abuse.ch) · Generic.Malware (Hybrid-Analysis) · Gen:Variant.Razy (Hybrid-Analysis)

eccoclean.hopto.org Hostname

modified 2026-10-16 20:37:25
Ave Maria (ThreatFox Abuse.ch)

eriwauwa.duckdns.org Hostname

modified 2026-10-16 20:37:24
Ave Maria (ThreatFox Abuse.ch) · Trojan.Generic (Hybrid-Analysis)

vasticbless.hopto.org Hostname

modified 2026-10-16 20:36:42
Ave Maria (ThreatFox Abuse.ch)

eurolord.duckdns.org Hostname

modified 2026-10-16 20:35:12
Malware.Generic (Hybrid-Analysis) · Ave Maria (ThreatFox Abuse.ch)

anglekeys.warzonedns.com Hostname

modified 2026-10-16 20:35:04
Ave Maria (ThreatFox Abuse.ch) · Gen:Variant.Mikey (Hybrid-Analysis)

warmoni147.duckdns.org Hostname

modified 2026-10-16 20:35:02
Ave Maria (ThreatFox Abuse.ch)

obibryme.ddns.net Hostname

modified 2026-10-16 18:49:50
Ave Maria (ThreatFox Abuse.ch)

152.89.160.131 IPv4

modified 2026-10-16 18:43:57
Ave Maria (ThreatFox Abuse.ch) · Unknown malware (ThreatFox Abuse.ch) · Anonymizer (Maltiverse) · TOR Exit Node (TorProject.org) · HTTP Spammer (StopForumSpam.com)

3.126.224.214 IPv4

modified 2026-10-16 17:41:47
Ave Maria (ThreatFox Abuse.ch) · RedLine Stealer (ThreatFox Abuse.ch) · Nanocore RAT (ThreatFox Abuse.ch) · Asyncrat (Maltrail) · NjRAT (ThreatFox Abuse.ch)

bc2c6dfda9f39adcf8ad76c613614790574b78278277f5f6f688307f8cd15d1d Sample

modified 2026-10-16 17:12:37
Warzone (Cyber Threat Alliance)

ebase.duckdns.org Hostname

modified 2026-10-16 16:40:17
Ave Maria (ThreatFox Abuse.ch) · Gen:Variant.Strictor (Hybrid-Analysis)

spicydojo.duckdns.org Hostname

modified 2026-10-16 16:38:04
Ave Maria (ThreatFox Abuse.ch)

expressdelivery.info Hostname

modified 2026-10-16 16:38:02
Ave Maria (ThreatFox Abuse.ch)

waz.no-ip.ca Hostname

modified 2026-10-16 16:36:23
Ave Maria (ThreatFox Abuse.ch)

niggalips.hopto.org Hostname

modified 2026-10-16 16:35:49
Ave Maria (ThreatFox Abuse.ch)

crossedward26.duckdns.org Hostname

modified 2026-10-16 16:35:42
Ave Maria (ThreatFox Abuse.ch)

glorylnter.hopto.org Hostname

modified 2026-10-16 16:34:57
Ave Maria (ThreatFox Abuse.ch)

vodahelp.myvnc.com Hostname

modified 2026-10-16 16:33:20
Ave Maria (ThreatFox Abuse.ch)

olodofries88.ddns.net Hostname

modified 2026-10-16 16:33:15
Ave Maria (ThreatFox Abuse.ch) · Injector.YP.gen (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis)

newvic.myvnc.com Hostname

modified 2026-10-16 16:32:50
Ave Maria (ThreatFox Abuse.ch)

respainc.duckdns.org Hostname

modified 2026-10-16 12:40:13
Ave Maria (ThreatFox Abuse.ch)

jaiban.duckdns.org Hostname

modified 2026-10-16 12:39:48
Ave Maria (ThreatFox Abuse.ch)

osas212.ddns.net Hostname

modified 2026-10-16 12:38:55
Ave Maria (ThreatFox Abuse.ch)

putmein.zapto.org Hostname

modified 2026-10-16 12:37:47
Trojan.Streamer (Hybrid-Analysis) · Ave Maria (ThreatFox Abuse.ch)

santzo.warzonedns.com Hostname

modified 2026-10-16 12:37:26
Ave Maria (ThreatFox Abuse.ch) · Trojan.Generic (Hybrid-Analysis)

warsone.duckdns.org Hostname

modified 2026-10-16 12:37:25
Ave Maria (ThreatFox Abuse.ch)

msteelwar.ddns.net Hostname

modified 2026-10-16 12:37:13
Ave Maria (ThreatFox Abuse.ch)

zcv2ngnfg69354253.3utilities.com Hostname

modified 2026-10-16 12:37:13
Ave Maria (ThreatFox Abuse.ch)

hjjhjkk.ydns.eu Hostname

modified 2026-10-16 12:37:13
Ave Maria (ThreatFox Abuse.ch)

xpwarzonlicns2.ddns.net Hostname

modified 2026-10-16 12:36:38
Ave Maria (ThreatFox Abuse.ch)

masterhugo231.servecounterstrike.com Hostname

modified 2026-10-16 12:35:38
Ave Maria (ThreatFox Abuse.ch) · Generic.Malware (Hybrid-Analysis) · Casur.A (Hybrid-Analysis)

andronmatskiv20.sytes.net Hostname

modified 2026-10-16 12:34:47
Ave Maria (ThreatFox Abuse.ch)

avira-antivirus.ydns.eu Hostname

modified 2026-10-16 12:34:02
Ave Maria (ThreatFox Abuse.ch)

newnex.3utilities.com Hostname

modified 2026-10-16 12:33:39
Ave Maria (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

b37fd137e3dd8837036ab0d2a6f5c34eaf147fbcb3c9abd669ec49fc5da8044e Sample

modified 2026-10-16 11:10:09
Warzone (Cyber Threat Alliance)

ca-fax123.home-webserver.de Hostname

modified 2026-10-16 10:24:39
Ave Maria (ThreatFox Abuse.ch)

1a6cde417b402b9fb1e919d8b50255b3463420b5f92c9c2d39715210a4cfba1d Sample

modified 2026-10-16 09:37:37
Warzone (Cyber Threat Alliance)

wz-patient001.duckdns.org Hostname

modified 2026-10-16 08:39:39
Ave Maria (ThreatFox Abuse.ch)

checkingss.duckdns.org Hostname

modified 2026-10-16 08:39:13
Ave Maria (ThreatFox Abuse.ch)

ccnewcdt.duckdns.org Hostname

modified 2026-10-16 08:38:12
Ave Maria (ThreatFox Abuse.ch) · Agent Tesla (Maltrail)

dbensoaupthreesdopsopsseead.ydns.eu Hostname

modified 2026-10-16 08:38:12
Ave Maria (ThreatFox Abuse.ch)

ontmintuejio.sytes.net Hostname

modified 2026-10-16 08:37:31
Injector.EPMQ (Hybrid-Analysis) · FileRepMalware (Hybrid-Analysis) · Ave Maria (ThreatFox Abuse.ch)

mamased.duckdns.org Hostname

modified 2026-10-16 08:37:23
Ave Maria (ThreatFox Abuse.ch) · Trojan.AgentWDCR (Hybrid-Analysis)

recieviblrggg.duckdns.org Hostname

modified 2026-10-16 08:37:22
Ave Maria (ThreatFox Abuse.ch)

dfdgdsasedw.ydns.eu Hostname

modified 2026-10-16 08:37:14
Ave Maria (ThreatFox Abuse.ch)

efiigbo9.duckdns.org Hostname

modified 2026-10-16 08:36:43
Ave Maria (ThreatFox Abuse.ch) · Malware.Generic (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis) · Agent Tesla (Maltrail)

goalblistr.ydns.eu Hostname

modified 2026-10-16 08:36:30
Ave Maria (ThreatFox Abuse.ch)

rex1010.duckdns.org Hostname

modified 2026-10-16 04:41:26
Ave Maria (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

lindsaystewart113.hopto.org Hostname

modified 2026-10-16 04:41:10
Ave Maria (ThreatFox Abuse.ch)

mirandinha.warzonedns.com Hostname

modified 2026-10-16 04:41:03
Ave Maria (ThreatFox Abuse.ch)

sheb.ddns.net Hostname

modified 2026-10-16 04:40:09
Ave Maria (ThreatFox Abuse.ch)

just-fax207.home-webserver.de Hostname

modified 2026-10-16 04:38:20
Ave Maria (ThreatFox Abuse.ch)

3a17b44f4a5c2195f418e21426f45455cf66a72c34cbd3eda01ce7b105c697d1 Sample

modified 2026-10-16 02:24:38
Warzone (Cyber Threat Alliance)

ac530b7fb707869f26d34a65cea24c7d5e6ebbc9f8e2d61b6c6ed18ce18e450b Sample

modified 2026-10-16 02:23:38
Warzone (Cyber Threat Alliance)

1f9e07ec868bfdae952fcebd033f604646677e77620006336ecea4a9d5c34ec4 Sample

modified 2026-10-16 02:23:38
Warzone (Cyber Threat Alliance)

104.254.90.195 IPv4

modified 2026-10-15 22:34:22
HTTP Spammer (StopForumSpam.com) · HTTP Spammer (Sblam) · Ave Maria (ThreatFox Abuse.ch) · Mail Spammer (Blocklist.de) · HTTP Attacker (BadIPs)

jaffacakes118_Trojan.Win32.Agentb.jiad.a2d56f816f9dd7c29aab586e1551411f Sample

modified 2026-10-15 21:26:51
Warzonerat (Triage)

86128261bd3bee7d33e9030f49b19cf44147f620a7eefc0e82bf32ada38cb370 Sample

modified 2026-10-15 21:09:37
Warzone (Cyber Threat Alliance)

members-path.at.ply.gg Hostname

modified 2026-10-15 20:38:09
XWorm (ThreatFox Abuse.ch) · NjRAT (ThreatFox Abuse.ch) · Ave Maria (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

4610215325.redirectme.net Hostname

modified 2026-10-15 20:36:14
Ave Maria (ThreatFox Abuse.ch)

phaz6434325328.redirectme.net Hostname

modified 2026-10-15 20:36:12
Ave Maria (ThreatFox Abuse.ch) · FileRepMalware (Hybrid-Analysis)

bluemail-fax.home-webserver.de Hostname

modified 2026-10-15 12:38:46
Ave Maria (ThreatFox Abuse.ch)