ae1ad5768cc3293c76f30e8c741a467faffe548ec245e2ff819b479c35febb25

General

Target
FortniteAccountPuller.exe
Size 76KB
Sample260707-a6ff6sbx5m
SHA256 ae1ad5768cc3293c76f30e8c741a467faffe548ec245e2ff819b479c35febb25
MD5 e368de8070d5894c4f0fd19c11fb73a0
SHA1 ad8d439086943f458bd4eca524db2009312a628e
SHA512 2a1523c0388f11640ed86067d98315c10809d3e64b1cb8f4bc8a31d740e3af57ac41febab03c04f2b26e3e23e5746dddee98b4c0c6c1d4e5db378067b25fb102
SSDEEP 1536:HR9lxiSSVSxV9Z0LYvRiYs1hemH8oQ+tGSbbd96VAJ:Hz8VSJ28RiYs1hemcoQ+tGSbbnWAJ
TLSH
T19A730826DE15807DE29AC678C9976D01EB727C8A87D2A7CF57D00CE20D5A7D09F3A603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  FortniteAccountPuller.exe
- Size 76KB
- SHA256 ae1ad5768cc3293c76f30e8c741a467faffe548ec245e2ff819b479c35febb25
- MD5 e368de8070d5894c4f0fd19c11fb73a0
- SHA1 ad8d439086943f458bd4eca524db2009312a628e
- SHA512 2a1523c0388f11640ed86067d98315c10809d3e64b1cb8f4bc8a31d740e3af57ac41febab03c04f2b26e3e23e5746dddee98b4c0c6c1d4e5db378067b25fb102
- SSDEEP 1536:HR9lxiSSVSxV9Z0LYvRiYs1hemH8oQ+tGSbbd96VAJ:Hz8VSJ28RiYs1hemcoQ+tGSbbnWAJ
- TLSH
  T19A730826DE15807DE29AC678C9976D01EB727C8A87D2A7CF57D00CE20D5A7D09F3A603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution exploit impact persistence ransomware spyware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2