delete_fortnie_cheat__spoofer_1.rar
- SHA256 20afc142a26c094db25ede02fc13e99acc4a4431db32ecd2d3be05b9e3f852bc
Static task
static1
Behavioral task
behavioral1
Sample
delete fortnie cheat + spoofer/deletefortnitecheat.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
delete fortnie cheat + spoofer/deletefortnitecheat.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
delete fortnie cheat + spoofer/deletespoofer.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
delete fortnie cheat + spoofer/deletespoofer.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target delete_fortnie_cheat__spoofer_1.rar
- Size 156KB
- Sample220204-3va2jafghm
- SHA256 20afc142a26c094db25ede02fc13e99acc4a4431db32ecd2d3be05b9e3f852bc
- MD5 102bd07e7adcf58e2298d103062e1092
- SHA1 1d69e070f3fc4e6971642840f67dd6c575ef858f
- SHA512 95d12cb0523aa466a268762f7787dfd4c13474b7d27d51a1f511add3be9b2823ca2476a75c5e95aff3719d4f88111286d18b18fc6168b575d69f32bbf669f769
- SSDEEP 3072:8EayPypUU/iydmEKpSygLR4ptup+7AfMksNCjb0xuMlu:ZaFpUaiyxb+7A0kfb0xNlu
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detected Mercurial Grabber 1 IoCs
resource yara_rule static1/unpack001/delete fortnie cheat + spoofer/deletespoofer.exe family_mercurialgrabber - Mercurialgrabber family
File Explorer
-
delete_fortnie_cheat__spoofer_1.rar.rar 156KB
-
delete fortnie cheat + spoofer/deletefortnitecheat.exe.exe 271KB
-
delete fortnie cheat + spoofer/deletespoofer.exe.exe 42KB
-
delete fortnie cheat + spoofer/key.txt20B
-
delete fortnie cheat + spoofer/read me (instructions).txt1KB
delete fortnie cheat + spoofer/deletefortnitecheat.exe
- IMPHASH 17f03d29d77e9cc9ea8d9554d7e61c10
- SHA256 c82d2bb57555ea8f65b5a37841044b2d5f569ea16955358ed55b03ea0a0eed14
- MD5 9bbf2e88e6ba430797350cbaaaccc532
- SHA1 0d32ac3a2cba07cdda18c18844bfd77babc586bc
- SHA512 f2b5ff57a8ce0bf5d23892a96492ef081db6db88553075cb05e5c6f3c08b5a7e17bb25e2536afae601de21f9ea493e0fd7f4fbf22e4b62fd7061aeb667ade25d
- SSDEEP 6144:aXl8xCw1H+iXf8CjRW/zxrzlwLunP2PshNZrn7aA/pz:a1WLHZLunP2P4rn7f
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
217168
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dwmapi
DwmExtendFrameIntoClientArea
kernel32
Process32First
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
DeviceIoControl
CreateToolhelp32Snapshot
Sleep
Process32Next
CloseHandle
CreateThread
GetProcAddress
CreateProcessA
GetCurrentProcess
CreateFileA
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
EnterCriticalSection
LeaveCriticalSection
user32
GetWindowThreadProcessId
GetWindow
DispatchMessageA
GetWindowRect
GetClientRect
DestroyWindow
SetWindowPos
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetWindowLongA
MessageBoxA
GetForegroundWindow
MoveWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
mouse_event
PeekMessageA
ReleaseCapture
SetCursor
SetCapture
SetClipboardData
GetClipboardData
ClientToScreen
GetCapture
SetCursorPos
GetActiveWindow
ScreenToClient
LoadCursorA
GetKeyState
UpdateWindow
RegisterClassExA
EmptyClipboard
FindWindowA
PostQuitMessage
GetCursorPos
OpenClipboard
CloseClipboard
advapi32
GetTokenInformation
OpenProcessToken
GetUserNameA
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
msvcp140
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
d3d9
Direct3DCreate9Ex
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
__std_terminate
strstr
memmove
memcpy
memchr
_CxxThrowException
__C_specific_handler
__current_exception_context
__std_exception_destroy
__current_exception
_purecall
memset
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
ftell
__p__commode
fflush
_set_fmode
__stdio_common_vsprintf_s
fclose
fseek
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
isprint
strcmp
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
system
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_invalid_parameter_noinfo_noreturn
terminate
_cexit
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
exit
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
pow
powf
cosf
sinf
fmodf
floorf
sqrt
asinf
tanf
sqrtf
__setusermatherr
ceilf
Name
.text
Size
212KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
delete fortnie cheat + spoofer/deletespoofer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ac6079fc9056ab5062e71edde29e7d204ce27ab5dd19e51c2f66c0441c28e0d3
- MD5 5b46c0aa6bafddf316af2a0771ecc731
- SHA1 c26c7a978aa1c4bb75db3facce673f9ef5dcc1ba
- SHA512 beb27b70f9d3666847f4d1042da9b68d787a43ab858254f063c900871a74e837e3e4b28379122af06802bc50dabbee66b54fc7a3d041e0f19a822cc23c1a68ac
- SSDEEP 768:D9A53RoQ/hfhuZyLHyTjHDKZKfgm3Ehrw:hMhfRLHyTvF7Epw
- MD5 SHA1 SHA512 SSDEEP
-
Detected Mercurial Grabber
Minor OS version
Major OS version
Entry point
48158
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
delete fortnie cheat + spoofer/key.txt
- SHA256 f8c9af17f0b5025499c1a1d2f79bb555578327fbbc888cad14a10dbf267daa1f
- MD5 abac27a1ff8ba88eaf68bb69a30235cb
- SHA1 cdec913735a98fc638262824f0a54545460b5a4a
- SHA512 2e454ff3ad85480f216e41e4e76965ab5cb29f0a9b31ecb91a361f6b4ac8f175780a5a28c1ee652b764bc0186967eb67a58aa4ba6c862b79769275da5e100268
- MD5 SHA1 SHA512
delete fortnie cheat + spoofer/read me (instructions).txt
- SHA256 8cd8617ce12ab02d59e3e5dba1e29203e80b52e61925074a7010384e0702a2f7
- MD5 60de9fbb4eba4daab76c4e5b40a2faa8
- SHA1 9943af462876ac46ed860f7cca8edf0b44a73e4f
- SHA512 73dcb8ef6a3919dee0861e28b6a7d07d0cc7f7f16e8c0f4665426b6dcc04c71d30a3ef664cca52a513ab86b70f2a801cdbee193517a57ea219dccdf163777892
- SSDEEP 48:8JMMMMMunMMMMMMMMMMMMM8ooMMMMMMMMMMMMMlxMMMMMMMMMMMMOlMMMMMMMMMG:8XlQ8eebrccEUYpTttq
- MD5 SHA1 SHA512 SSDEEP