General

  • Target

    Fortnite Accounts Checker BY X-SLAYER.exe

  • Size

    1.8MB

  • Sample

    241230-k1nkpstphq

  • MD5

    88ad4c9d421e7048ed4f7599b2fb7204

  • SHA1

    41c238b67e3d16ee866cf652680ded68d52c3815

  • SHA256

    86b1e6b0bc4305085793f8110d62411ce2880f3dc8501ccd35419db65dd854ef

  • SHA512

    5cee89157ef54aa43fa2861631db5d4d2e97134d96ffbae4c03092aa352b816ebdf86be97acc3958ffd0d8fb5fd4340dfa3276958dd090505be0b791f0d67b31

  • SSDEEP

    24576:HJTZtuky+rjj9tL8ZMEiDfWbcp+2dnTLcb24EgU1oeImW3:pM+YMEbC+2Vsjn

Malware Config

Extracted

Family

amadey

Version

5.10

Botnet

0f3be6

C2

http://185.81.68.147

http://185.81.68.148

Attributes
  • install_dir

    ee29ea508b

  • install_file

    Gxtuum.exe

  • strings_key

    d3a5912ea69ad34a2387af70c8be9e21

  • url_paths

    /7vhfjke3/index.php

    /8Fvu5jh4DbS/index.php

rc4.plain

Targets

    • Target

      Fortnite Accounts Checker BY X-SLAYER.exe

    • Size

      1.8MB

    • MD5

      88ad4c9d421e7048ed4f7599b2fb7204

    • SHA1

      41c238b67e3d16ee866cf652680ded68d52c3815

    • SHA256

      86b1e6b0bc4305085793f8110d62411ce2880f3dc8501ccd35419db65dd854ef

    • SHA512

      5cee89157ef54aa43fa2861631db5d4d2e97134d96ffbae4c03092aa352b816ebdf86be97acc3958ffd0d8fb5fd4340dfa3276958dd090505be0b791f0d67b31

    • SSDEEP

      24576:HJTZtuky+rjj9tL8ZMEiDfWbcp+2dnTLcb24EgU1oeImW3:pM+YMEbC+2Vsjn

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks