General
-
Target
FortniteExe-1.1.5.exe
-
Size
78KB
-
Sample
250207-gh4bna1lfs
-
MD5
c73bba30143d2b65d806bd6a9057b4cc
-
SHA1
02af5d3cc2d15758e27aa2b02eb5a766777d4a4c
-
SHA256
18156c39afcf34fe36b6699f4f5524f4a3f6550f3f1b795cee57bed5f7088f08
-
SHA512
3d206952aa9846aa0851dd8815b984f681f00a58c999e2b1addfdef806f0f680f562376aac697ed42fafdedfa8cc0a4785fe05d292983773f6eccd2fdd55fbcb
-
SSDEEP
1536:UU1gcxe1eHCZWPMVKe9VdQuDI6H1bf/mcEN1fQzcHIYVclN:UUKcxe1ayWPMVKe9VdQsH1bfecEN1fQf
Behavioral task
behavioral1
Sample
FortniteExe-1.1.5.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
83.229.86.210:4449
oujrhbnoysbkcdzrmt
-
delay
1
-
install
true
-
install_file
Xeno.exe
-
install_folder
%AppData%
Targets
-
-
Target
FortniteExe-1.1.5.exe
-
Size
78KB
-
MD5
c73bba30143d2b65d806bd6a9057b4cc
-
SHA1
02af5d3cc2d15758e27aa2b02eb5a766777d4a4c
-
SHA256
18156c39afcf34fe36b6699f4f5524f4a3f6550f3f1b795cee57bed5f7088f08
-
SHA512
3d206952aa9846aa0851dd8815b984f681f00a58c999e2b1addfdef806f0f680f562376aac697ed42fafdedfa8cc0a4785fe05d292983773f6eccd2fdd55fbcb
-
SSDEEP
1536:UU1gcxe1eHCZWPMVKe9VdQuDI6H1bf/mcEN1fQzcHIYVclN:UUKcxe1ayWPMVKe9VdQsH1bfecEN1fQf
-
Asyncrat family
-
Venomrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-