�.aH�$����O�`�d+gh��O+�4�S�p>�� ���,-�ƴm�X:8��qR�c��� ��H��Ʉ0Q'L��d���a>�8���`Zy�����+����t��B"L�j�~�A���߀Y��x��c����f&�A��i��R\v��-Q$�d1��I쫊���=攨���.��'��'d������V:��������?��r��@���7 ����"M)���q_/G:�����A����� PjxOAZz�<Q+�rc�?�5U����9M�Ni�4��I��e���d[��W�<�\��=���FN89���:1� ,�9eA3��I �4��+���o?����[�=�S47�|:܌at�f� �8ԑw2�լ���/+8�a~�9����27��#D;n�-���N��{�#z���"� ����K��2W>LLI�w|9z����c���Tskv\$�����-��a�R��>.�c$p����|������MQ������㰤�� F����˩�8R}5�\������� �#����8Z�D�;ts��6�8�4g�IO�^$��os�\�k���H\4:y�H.��\�6�_������Cq��.��ؘ�cW��_s��/�;3xb�L��9Z.R��>m��B�r��!�M�v�5)-���[�B�)��w��H�~��j��T�B�1\��C0��o�bX�J>_�nJ���_Ș����#XOI9"���c��{��\v|��� �ĺ��̟?_`b�H0|1͙���f��4�;#�A�Gܨ��!�A[��C� ���(����Kx&�3g���L����J���\�dꋁ �f�<\r&�n��F)(/K=�Wڱ:<e���Vk*�Zw����O��(�XIu�$hX���'��h{�����2�/�Y7��oL[��͓��& Z)�s������L�ˉ5�������"�=GĠ^��$���|l�r�X��Yt����C��7�.��� 8B�����͵��I�^�g�$�p����HZ��7�J5��q���r����dGJ)�U`�QG�J�Ғ+����8 Yk!��5��cX� ��7�lB^�O.瓉�] Rs�?q��.����%����}t�ȑ�䮚�a�0O�����S�����Õ�B+�c�ڮ���ۿ�|U����ɓX��S�tɉnSA= ��>�F�LP�U?�<��gJʰ��\e�H���s�q�i@�]�� (�[9:�^Ld�oP��aA�v@��H6H]�N� �,;�|0ϔ�:^����8��u�o��Sϙ��F������-���q2�/�Y�a.�z�1S��a�/=�o�������=�Ư��4���A\����p&�ɛ�z�y؇��+�wTC߮��;�x����t��^=���?�em�� ���]{�'� �E#�$�� k�O(<� ����X�g�zۤ��\5���Bg�@\C��a�y��CyY���؊��2T P`�Y�u'At��>�Zck���8Z^��'[-�u���|�-y]��ѫ��`�>����E� r)�W�q�į�f~�� bR�].=�cb5̅�E=�Y����Z�U������\������e�A���dCPnlI�c}�����P-�[�H�C{�V�R����S؝�[(I�#h)��ժx�_5,�����fWb���k��t���d����>�q���vi�g(oE�b ��_��`����Uz��:t5�!>��q���������A���o�j�wHX�H��������KX�����c���m�����4���ʶ����.Y��'u�"_@�`ӲLq"���C�M-D s�O�s�-�--mah�����y�!������G?�HT�UYZ]���=���#v��sQ �b�K!��=���c[-K��#n��qY/B�����R���%�����'U�������ڂ���]�+W]�ʿ��\�R൵wg͜f�T<?!�zs���� ˍNJg��X%���|���)��[5��9��� �Ͽ�q����DCc�R���\���WE.�����_����pvx?��c>�e4��� ��wۄ�BN�?m�f��O�ޤ+���u�s���C��-�O��1!��O�0b�M�����Z��3��{�;����%C��(��)���9����M���D2����eҘ��M87Eh��{����M�a��rI&�8�%/�i��3�$��TzV��e�XG�ė-��q�b���+ܡp�X �Cφ��EV�2.�>�z��ؐ#����S?v� �[������E7��A�|�b�f��r�sja�l��iW������tT����p_��߭- �������]��FZ��.�%4a��'�~7Ǻ�f��b�}�!(�2W�1U(0nR�eu8c����8K�7+}|���J�q��7��²�{���O-�mXpw���\XݝhI�T�l^�F�p�yZ��k}Y|�)G2P��������ėL��J0 r����m�o�����y)V`mN��2b�0ŏàS��d1���vI<D�����C��5��߾�y��0�0*���3��c�D���5�Ja �<M?��H���ݎg�Xِ�$,]�3P�<�'�!�!l�oF�ԫ��Y�x��9Z�uh%�e����s!Z>�A�@��*T�ʿƓ��U�V��Y�U(s�`��{�cœ�<�;l�%N�!���I��v�UN���� �I� )=q~�f^���'��KF{>��Y3-/���N�����T�(��$j[E�7���eo���,�ˡ��I���m&�Me1z��s�!�$�ы�:}^�����"�άŪL��xFY���mg r�##A�RM�z0�2�5��Z����Ի�X���f�?���Y����Ut�+�2o���Wpb"�mi�w��(������X.�rAEc��t5��&�\�A�:���!��Q�uPv8�U��.�T��E�l0�>wy��Jr���{'�����Ѳ�[� 3�� ��.쾸h~��O���\}loe�Ϊ��qԳ�P�֍�=p��p�
Overview
overview
10Static
static
3FORTNITECHEAT.exe
windows7-x64
10FORTNITECHEAT.exe
windows10-2004-x64
10Installer2.exe
windows7-x64
10Installer2.exe
windows10-2004-x64
10Zeus.exe
windows7-x64
10Zeus.exe
windows10-2004-x64
10installer.exe
windows7-x64
10installer.exe
windows10-2004-x64
10lnjector.exe
windows7-x64
10lnjector.exe
windows10-2004-x64
10setup.exe
windows7-x64
10setup.exe
windows10-2004-x64
10Static task
static1
Behavioral task
behavioral1
Sample
FORTNITECHEAT.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FORTNITECHEAT.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Installer2.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Installer2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Zeus.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Zeus.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
installer.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
installer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
lnjector.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
lnjector.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
setup.exe
Resource
win7-20241023-en
General
-
Target
5031f42bb5fc965f36d16c261032db382e9746ecbd58cda03fa40ef286738a74
-
Size
11.3MB
-
MD5
3e54734beeaab8a1fde7ae62163ef97f
-
SHA1
0d7de22c9534ff452cf0104a484df9c3718de10f
-
SHA256
5031f42bb5fc965f36d16c261032db382e9746ecbd58cda03fa40ef286738a74
-
SHA512
0bd34c8af6917bb636d67520ded3539f189fd7c652be7de5e194fb164cbba9fd39a7096521f6f946e5189fa94940fc08c01a2237d9088d588e72712255fa3998
-
SSDEEP
196608:bD3EqO0VD50ms/HF/y/LUtvUIXQWSbANfzDn3KeEDH1FtMKny/9opxM9yIm:PXJ5VsPF0LIvKTURf3KeED3Qmi1m
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/FORTNITECHEAT.exe unpack001/Installer2.exe unpack001/Zeus.exe unpack001/installer.exe unpack001/lnjector.exe unpack001/setup.exe
Files
-
5031f42bb5fc965f36d16c261032db382e9746ecbd58cda03fa40ef286738a74.zip
-
FORTNITECHEAT.exe.exe windows:6 windows x86 arch:x86
053b57407c0a4687055033f4f7cf7682
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetStockObject
DeleteObject
SetBkMode
SetTextColor
CreateFontIndirectA
SelectObject
GetObjectA
user32
GetDlgItem
SendDlgItemMessageA
AppendMenuA
CreatePopupMenu
DestroyMenu
ClientToScreen
TrackPopupMenu
GetCursorPos
SendMessageA
GetDlgItemTextA
wsprintfA
MessageBoxA
LoadCursorA
GetActiveWindow
CheckDlgButton
SetWindowTextA
kernel32
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCurrentThreadId
SuspendThread
GetLogicalDrives
GetModuleHandleA
GetProcAddress
FreeConsole
GetCommandLineA
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Installer2.exe.exe windows:6 windows x86 arch:x86
bbaf413d7af43547f2d52b7544be7cd2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
FreeConsole
VirtualProtectEx
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetFileSizeEx
SetFilePointerEx
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
ReadConsoleW
HeapSize
WriteConsoleW
Sections
.text Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 205KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Zeus.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
installer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
lnjector.exe.exe windows:6 windows x86 arch:x86
fe6c9b473349465e571611857ce5cb94
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AuditFree
kernel32
VirtualProtect
FreeConsole
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
HeapReAlloc
GetFileSizeEx
SetFilePointerEx
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
ReadConsoleW
HeapSize
WriteConsoleW
Sections
.text Size: 251KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 181KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
setup.exe.exe windows:5 windows x86 arch:x86
1f7cd8d90203e6491ca03db8d413ec06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAllocExNuma
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateDCA
ole32
CoCreateInstance
oleaut32
VariantInit
Exports
Exports
Sections
.text Size: - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.O?Q Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.E>x Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.)ji Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 446KB - Virtual size: 446KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ