General
-
Target
Fortnite Accounts Checker BY X-SLAYER.exe
-
Size
1.8MB
-
Sample
241230-k1nkpstphq
-
MD5
88ad4c9d421e7048ed4f7599b2fb7204
-
SHA1
41c238b67e3d16ee866cf652680ded68d52c3815
-
SHA256
86b1e6b0bc4305085793f8110d62411ce2880f3dc8501ccd35419db65dd854ef
-
SHA512
5cee89157ef54aa43fa2861631db5d4d2e97134d96ffbae4c03092aa352b816ebdf86be97acc3958ffd0d8fb5fd4340dfa3276958dd090505be0b791f0d67b31
-
SSDEEP
24576:HJTZtuky+rjj9tL8ZMEiDfWbcp+2dnTLcb24EgU1oeImW3:pM+YMEbC+2Vsjn
Behavioral task
behavioral1
Sample
Fortnite Accounts Checker BY X-SLAYER.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Fortnite Accounts Checker BY X-SLAYER.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
amadey
5.10
0f3be6
http://185.81.68.147
http://185.81.68.148
-
install_dir
ee29ea508b
-
install_file
Gxtuum.exe
-
strings_key
d3a5912ea69ad34a2387af70c8be9e21
-
url_paths
/7vhfjke3/index.php
/8Fvu5jh4DbS/index.php
Targets
-
-
Target
Fortnite Accounts Checker BY X-SLAYER.exe
-
Size
1.8MB
-
MD5
88ad4c9d421e7048ed4f7599b2fb7204
-
SHA1
41c238b67e3d16ee866cf652680ded68d52c3815
-
SHA256
86b1e6b0bc4305085793f8110d62411ce2880f3dc8501ccd35419db65dd854ef
-
SHA512
5cee89157ef54aa43fa2861631db5d4d2e97134d96ffbae4c03092aa352b816ebdf86be97acc3958ffd0d8fb5fd4340dfa3276958dd090505be0b791f0d67b31
-
SSDEEP
24576:HJTZtuky+rjj9tL8ZMEiDfWbcp+2dnTLcb24EgU1oeImW3:pM+YMEbC+2Vsjn
Score10/10-
Amadey family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-