Overview

overview

10

Static

static

3

fortnite.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fortnite.exe

  • Size

    1.3MB

  • Sample

    241105-ryd2tavqcp

  • MD5

    0688232848fc2a978afa8c62cf980ed2

  • SHA1

    e88bb4807d2227549d2dfb9f107047edd1c67562

  • SHA256

    4c84f35a3774acf5e8dbae782a313b5088088f57ee59cabdefb5e0185a000636

  • SHA512

    930234a665b85e50ce03e5e13e7fe3e4efc6cb59a4d2e18baa22361c24b82e686ba28d2f1d0be60071daff4cbf46497e4922ec0a3ac15b367ba9206ee8d81dde

  • SSDEEP

    12288:yqc9xDJIzaaEXoxJ6rWvun4UxCj2AqeMQmhkZQyRWkhuq3nbep3+bKDZhW/lc4lO:OxdYcSvun4uGKFhklpC+bKlAtc06cg

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      fortnite.exe

    • Size

      1.3MB

    • MD5

      0688232848fc2a978afa8c62cf980ed2

    • SHA1

      e88bb4807d2227549d2dfb9f107047edd1c67562

    • SHA256

      4c84f35a3774acf5e8dbae782a313b5088088f57ee59cabdefb5e0185a000636

    • SHA512

      930234a665b85e50ce03e5e13e7fe3e4efc6cb59a4d2e18baa22361c24b82e686ba28d2f1d0be60071daff4cbf46497e4922ec0a3ac15b367ba9206ee8d81dde

    • SSDEEP

      12288:yqc9xDJIzaaEXoxJ6rWvun4UxCj2AqeMQmhkZQyRWkhuq3nbep3+bKDZhW/lc4lO:OxdYcSvun4uGKFhklpC+bKlAtc06cg

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks