Overview

overview

10

Static

static

3

FortniteExternal.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FortniteExternal.exe

  • Size

    37KB

  • Sample

    241229-lhf9caykev

  • MD5

    ba116c70830d49029c03acbb2f2fac1b

  • SHA1

    ec5de491b7910e25b5bfb7e8803b30186b38a71d

  • SHA256

    96391e7351eeec459e219aa35afd521e528eca4bf32d0aaf4ff018392c4894e3

  • SHA512

    768328944e44f88fc116376045b934ab251362ea41349ce0c4b968abbb09ce6a3060d70cd75344acb72b6db8c51c164dcf56ac3279ca2e1608bbbbc65b09c410

  • SSDEEP

    384:aLi12fprueXnMnUNGNlrFV5ga0gEVjIMDYf4/ERnvawR6KhzVcQSgafw2IwrWGcp:+Im6nUjIMDPEJ5h3X2rjmeCt070H7

Score
10/10
quasarpersistenceprivilege_escalationspywaretrojanupx

Malware Config

Targets

    • Target

      FortniteExternal.exe

    • Size

      37KB

    • MD5

      ba116c70830d49029c03acbb2f2fac1b

    • SHA1

      ec5de491b7910e25b5bfb7e8803b30186b38a71d

    • SHA256

      96391e7351eeec459e219aa35afd521e528eca4bf32d0aaf4ff018392c4894e3

    • SHA512

      768328944e44f88fc116376045b934ab251362ea41349ce0c4b968abbb09ce6a3060d70cd75344acb72b6db8c51c164dcf56ac3279ca2e1608bbbbc65b09c410

    • SSDEEP

      384:aLi12fprueXnMnUNGNlrFV5ga0gEVjIMDYf4/ERnvawR6KhzVcQSgafw2IwrWGcp:+Im6nUjIMDPEJ5h3X2rjmeCt070H7

    Score
    10/10
    quasarpersistenceprivilege_escalationspywaretrojanupx

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks