Overview

overview

10

Static

static

10

Fortnite (1).exe

windows7-x64

10

Fortnite (1).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    250104-dhxmbsxqav_pw_infected.zip

  • Size

    32.6MB

  • Sample

    250104-dtbt1aykhx

  • MD5

    04860a6060aba34774ca7e2c3beae184

  • SHA1

    60787b62e17825235b195201dcc84eeaf42eb07a

  • SHA256

    938d01521eeeb3022993f0ee6546394ae2c852ed20168b026c46b23201ca7bf4

  • SHA512

    81a6d47f0562eb1c94be427afec0f154a704b5295672319ba24c703173484ddd94994e766ec82b71c9f9f95479c9357e49e51057c3a15c2f02fbb3688247cb1a

  • SSDEEP

    786432:plnBjuqcisTiYZyL3C/ukgwjV3MShy9FxRnOr7HusSmObHKdJ1Pol:pDuqcisTiYkLyqw1hy9T27O7udJ1Pol

Score
10/10
pysilonredtigerdiscoveryevasionpersistencepyinstallerstealerupx

Malware Config

Targets

    • Target

      Fortnite (1).exe

    • Size

      32.9MB

    • MD5

      396020facd54f9113325f71d02015af5

    • SHA1

      f2f2e0ede5dcb9e979884c925dc2b0878d69a33e

    • SHA256

      42532da2345fa4d3867a3898f9f42de85afe18571a6a0be00d0260e788317192

    • SHA512

      2b97304e492ddd1a2b3f8be495bb1b2049ca7d4b3d0c81f4fa5d48df8b24a8a9ddf8f3f47a87fa7dd60d9a750099add15c05db2ae8bb63242307a2326ea2ab89

    • SSDEEP

      786432:mow/lhOpW8428m1NxOwxJl8dPXB6BYeB4isdg+CxeDSaq3k0:ClhYWA8mxBlmPxaYeBSa4SNb

    Score
    10/10
    redtigerdiscoveryevasionpersistencepyinstallerstealerupx

    • Detects RedTiger Stealer

      stealer

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Redtiger family

      redtiger

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks