Overview

overview

10

Static

static

3

EzFN-Manager.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EzFN-Manager.exe

  • Size

    10.5MB

  • Sample

    241029-rdd63swcqk

  • MD5

    e528490c86b7bbd42cee5eb2ec1dcaa0

  • SHA1

    758ea1f40317648d9c0eb6f3540158bdbc1860a4

  • SHA256

    a5b3e8a7c2cace998612199ffdfda738d3107ebafc810219c1a648467cefcb05

  • SHA512

    fce546b12944c6b08c016532a6f49fdb5d45412025de2600a59079f29323bb2732d756f802999a3fb46e84e52dd93c1c2acdde59a9feaf102546455976f41863

  • SSDEEP

    196608:HxmZUWfcvgWCpS1rpAcfBSOfMJiNbguUhFk7668rH55oHG:HwG0WCyrpAcfzf9bgT4xc5+G

Score
10/10
warzoneratdiscoveryexecutioninfostealerpersistencerat

Malware Config

Targets

    • Target

      EzFN-Manager.exe

    • Size

      10.5MB

    • MD5

      e528490c86b7bbd42cee5eb2ec1dcaa0

    • SHA1

      758ea1f40317648d9c0eb6f3540158bdbc1860a4

    • SHA256

      a5b3e8a7c2cace998612199ffdfda738d3107ebafc810219c1a648467cefcb05

    • SHA512

      fce546b12944c6b08c016532a6f49fdb5d45412025de2600a59079f29323bb2732d756f802999a3fb46e84e52dd93c1c2acdde59a9feaf102546455976f41863

    • SSDEEP

      196608:HxmZUWfcvgWCpS1rpAcfBSOfMJiNbguUhFk7668rH55oHG:HwG0WCyrpAcfzf9bgT4xc5+G

    Score
    10/10
    warzoneratdiscoveryexecutioninfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks