Extracted

Extracted

• • Target

    Fortnite Internal Esp AIm Clean Full_nls..scr

  • Size

    2.6MB

  • MD5

    5361a2f1d174599ebc5b6cc31daf86f2

  • SHA1

    ade74d0abac77203629b81513a739f11b39a52ef

  • SHA256

    55af1ee79176f2503dc6cee5464344e6bbcaa4e37b4ae7217922c8e56ec395cf

  • SHA512

    96381c583b975e4c2cd7ec70bd955936c48a9737036234241e37e73baf81c96cb28ab28d2fe3c53ed1e8ce0be641fba653d7e6877770cb8f60fb32f2c7b703b4

  • SSDEEP

    49152:j8ASxr7FEi5LbunhHpj5G3FVhIdag5SNHeGJWrz:jTSt7FEGnCdpj5G3FVq18gGJ

  Score

  10^/10

  persistenceasyncratblacknetuzvhe6windowsdefendrsmartscreenevasionrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence

    persistence

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2