General
-
Target
Fortnite HC.exe
-
Size
300.7MB
-
Sample
220922-fb2c2sdfdk
-
MD5
dfb304c0d31d80d01a7e34d19b74c1d2
-
SHA1
f769323bac3dc2a32e20d86d8756fd50c173a2d8
-
SHA256
254148d27811ea69ee72e93f32e2358c533636fd7d92116a84b2565d7abe6f46
-
SHA512
fb53f09ea7833a81d1a73f3570058962e09d852e0ffc54ce35da2bf2a9083250f270cd2e8df2edc3ee819a702f9e733041f6b4b60eca644cf5106e5e9b3b5d62
-
SSDEEP
6144:lOsp73QVLKg551dZch4RdESQdcdPlKg552d+yt4VagDXW8jOD/gS3gqA6/lkw3Rg:l7p7SLKg5ndS4EdcLF9W77gS3NWwa
Static task
static1
Behavioral task
behavioral1
Sample
Fortnite HC.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
redline
@cham1ng
193.106.191.160:8673
-
auth_value
296c18e34d670ae41d67c9e09e2546b7
Targets
-
-
Target
Fortnite HC.exe
-
Size
300.7MB
-
MD5
dfb304c0d31d80d01a7e34d19b74c1d2
-
SHA1
f769323bac3dc2a32e20d86d8756fd50c173a2d8
-
SHA256
254148d27811ea69ee72e93f32e2358c533636fd7d92116a84b2565d7abe6f46
-
SHA512
fb53f09ea7833a81d1a73f3570058962e09d852e0ffc54ce35da2bf2a9083250f270cd2e8df2edc3ee819a702f9e733041f6b4b60eca644cf5106e5e9b3b5d62
-
SSDEEP
6144:lOsp73QVLKg551dZch4RdESQdcdPlKg552d+yt4VagDXW8jOD/gS3gqA6/lkw3Rg:l7p7SLKg5ndS4EdcLF9W77gS3NWwa
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
XMRig Miner payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-