Overview

overview

8

Static

static

1

fortnite-s...y.html

windows7-x64

3

fortnite-s...y.html

windows10-2004-x64

8

Resubmissions

24-09-2024 22:54

240924-2vmjwstbja 10

24-09-2024 22:40

240924-2lz4masfmc 8

24-09-2024 22:31

240924-2ffg2asdkd 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fortnite-skin-changer-lobby

  • Size

    10KB

  • Sample

    240924-2ffg2asdkd

  • MD5

    e0884d5afacda7ac5d4dde84e12bdc5a

  • SHA1

    198d0bd0c6a64f6045a12dca89140cb972bebbe0

  • SHA256

    d0019364aa3673c7d62a615e41f98c0585b72808fe9e32714a73b33c52b5bdb8

  • SHA512

    865fb35d877f5d21b111815387f67a8e9dbd4e5423347954bae4c34422f0f6ac500480b102d2f90a37b3977689819d0f9a9947d9da912b29fae50d828930a155

  • SSDEEP

    192:zyHGqcEY1f+qL4lyVWdhQ82h83FEL1Q1Oso9X0F6YEUB2oKS19:wRcpf+NEknQBOTdEYz

Score
8/10
bootkitdiscoveryexecutionpersistence

Malware Config

Targets

    • Target

      fortnite-skin-changer-lobby

    • Size

      10KB

    • MD5

      e0884d5afacda7ac5d4dde84e12bdc5a

    • SHA1

      198d0bd0c6a64f6045a12dca89140cb972bebbe0

    • SHA256

      d0019364aa3673c7d62a615e41f98c0585b72808fe9e32714a73b33c52b5bdb8

    • SHA512

      865fb35d877f5d21b111815387f67a8e9dbd4e5423347954bae4c34422f0f6ac500480b102d2f90a37b3977689819d0f9a9947d9da912b29fae50d828930a155

    • SSDEEP

      192:zyHGqcEY1f+qL4lyVWdhQ82h83FEL1Q1Oso9X0F6YEUB2oKS19:wRcpf+NEknQBOTdEYz

    Score
    8/10
    discoverybootkitexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks