Extracted

Extracted

• • Target

    EzFN-Manager.exe

  • Size

    10.5MB

  • MD5

    e528490c86b7bbd42cee5eb2ec1dcaa0

  • SHA1

    758ea1f40317648d9c0eb6f3540158bdbc1860a4

  • SHA256

    a5b3e8a7c2cace998612199ffdfda738d3107ebafc810219c1a648467cefcb05

  • SHA512

    fce546b12944c6b08c016532a6f49fdb5d45412025de2600a59079f29323bb2732d756f802999a3fb46e84e52dd93c1c2acdde59a9feaf102546455976f41863

  • SSDEEP

    196608:HxmZUWfcvgWCpS1rpAcfBSOfMJiNbguUhFk7668rH55oHG:HwG0WCyrpAcfzf9bgT4xc5+G

  Score

  10^/10

  skuldwarzoneratdiscoveryexecutioninfostealerpersistenceratstealer

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2