General
- Target Fortnite+Checker.exe
- Size 77.5MB
- Sample240801-e5rj9ssbmm
- SHA256 0747bdbef42f7e6c804fd771e800bfa3e7fecf696e10d273953d3e35d75f2889
Score
10/10
Malware Config
Targets
-
- Target Fortnite+Checker.exe
- Size 77.5MB
- SHA256 0747bdbef42f7e6c804fd771e800bfa3e7fecf696e10d273953d3e35d75f2889
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 15KB
- SHA256 b4a60b0e4f82707a8c5fb7f3fc0cc78576c7b45217617185ab34a90e2e052208
Score3/10 -
- Target get_cookies.pyc
- Size 9KB
- SHA256 1078edad1660d103c2135793ea9707e4ef7877fb4be7b87c0e538ed84920212c
Score3/10 -
- Target misc.pyc
- Size 4KB
- SHA256 a8355eef70645468d11a410d1402e0cab31a194e87172b523b1ff3dea5dbb0c2
Score3/10 -
- Target passwords_grabber.pyc
- Size 7KB
- SHA256 8655f8885fa28c9633563e0264e65206eae277fb020f85a836be27f0fc3d7ec4
Score3/10 -
- Target source_prepared.pyc
- Size 168KB
- SHA256 edc439ceb8b105a84a60726e28a33825b1a76013e41d15eb496861ba1b9344be
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1