Extracted

• • Target

    FORTNITE-03-14-2

  • Size

    5KB

  • MD5

    c21af1dbcf4926583a7214ad933bc847

  • SHA1

    da3625bccfd9aafa98b1cac7d40e936eb265cfd2

  • SHA256

    0748771775b1c89525067071b0996a9a7a3eda72d055ca74c185cdcba57715c0

  • SHA512

    1ceec19f5fcce45ed9d1e6f19852e23b02b8be80f50239a6ff4cc31d96252eb1f0a58fe9e37180419cdfec8674686e9eb6741d322d4263701eb2897ee5d80f95

  • SSDEEP

    96:9suWzV3JLNDg3czfj1Z/I+jYpyuIPJjeIJumKEm2PVW:Yl715o6JjeeuUg

  Score

  10^/10

  persistenceredlinebootkitdiscoveryinfostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Registers COM server for autorun

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2