darkvision | fortnite[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fortnite.exe
Size 1.4MB
Sample241029-yta8payfpd
SHA256 d9d68a7e91ad17c3db6dd4f00b4ff9a27cc27e3da41f694f444b9514eda3072f
MD5 7f9573605fc3b7c5a13a4b09118c77e5
SHA1 2541aebb664df60b014a2093232cfd4994a9130c
SHA512 fce7e4fef0018a50ab7d306571d41bc8f25e6ba55edf6401b82192c25b25e6f9c39002347e5d92dc40c42bf534fb7c13ab7d53c0696ffadaeea82e9618231be1
SSDEEP 24576:HFe/U3CReTrOmfrD10xs76dJKnCjkIL4I9fGzPvW4C30Wemex2ze+9S4:HFeVROf31es7KcnD9RP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkvision

Malware Config

Extracted

Family

darkvision

154.216.17.115
https://rentry.co/razorrat/rawYDHXBF8ZTF

Signatures

Darkvision family
darkvision

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fortnite.exe

File Explorer

fortnite.exe

.exe 1.4MB

fortnite.exe

IMPHASH 5ce38834c70717c245b2cdc97e9bb8b2
SHA256 d9d68a7e91ad17c3db6dd4f00b4ff9a27cc27e3da41f694f444b9514eda3072f
MD5 7f9573605fc3b7c5a13a4b09118c77e5
SHA1 2541aebb664df60b014a2093232cfd4994a9130c
SHA512 fce7e4fef0018a50ab7d306571d41bc8f25e6ba55edf6401b82192c25b25e6f9c39002347e5d92dc40c42bf534fb7c13ab7d53c0696ffadaeea82e9618231be1
SSDEEP 24576:HFe/U3CReTrOmfrD10xs76dJKnCjkIL4I9fGzPvW4C30Wemex2ze+9S4:HFeVROf31es7KcnD9RP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Taylo\Downloads\nyuger\nyuger\Release\fortnite.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlPcToFileHeader RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlCaptureContext RtlUnwind

kernel32

CreateFileA CreateThread MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Process32First CreateToolhelp32Snapshot Sleep Process32Next CloseHandle WritePrivateProfileStringA Beep lstrcmpiA GetPrivateProfileStringA FindFirstFileExW FindClose HeapReAlloc GetFileAttributesExW CreateProcessW VirtualAlloc WaitForSingleObject GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW FreeLibraryAndExitThread VirtualFree SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize SetEndOfFile WriteConsoleW GetExitCodeProcess EncodePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitThread DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ReadFile ExitProcess GetModuleHandleExW FindNextFileW

user32

DispatchMessageA DestroyWindow SetWindowPos GetSystemMetrics ShowWindow GetAsyncKeyState MessageBoxA TranslateMessage PeekMessageA FindWindowA UpdateWindow SendInput GetKeyState LoadCursorA ScreenToClient ClientToScreen GetForegroundWindow SetCursor GetClientRect SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

630KB

Virtual Size

630KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

646KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

fortnite.exe

d3d11

dwmapi

ntdll

kernel32

user32

imm32

d3dcompiler_47

generic