c7175ecd7a04410adcabbb1d8f9f870db7bc050c9e93d59f699e677ffdce29aa

Sharing

Copy URL Twitter E-mail

General

Target
FortniteFreeSrc.rar
Size 112.0MB
Sample260709-dstcnac14t
SHA256 c7175ecd7a04410adcabbb1d8f9f870db7bc050c9e93d59f699e677ffdce29aa
MD5 413ac2f2cf6e5a782d7c3e5f5361c0db
SHA1 eb3f174cfc689903e3eb9a15dcc6861032a460a0
SHA512 df7a68a9a7724a68cc83c08ae91a97ba4ca6bec795f505ada0fa2fc11dc898a159bc2938758c13aef0750d5f9972496eb96b9df5b98eafee94a98b948609411d
SSDEEP 3145728:zDhnhBE5mHrYcDiCcztU9D3PosjRpAo8tsus1JBTG03x1T5z95:zDFhq5WYptztU90OphSs9DBlBX
TLSH
T1E1483362EEA27E51541AC708E1F34786518BF7FBE7E14046D528B6984A510BBCF28CCF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FortniteFreeSrc.rar
- Size 112.0MB
- SHA256 c7175ecd7a04410adcabbb1d8f9f870db7bc050c9e93d59f699e677ffdce29aa
- MD5 413ac2f2cf6e5a782d7c3e5f5361c0db
- SHA1 eb3f174cfc689903e3eb9a15dcc6861032a460a0
- SHA512 df7a68a9a7724a68cc83c08ae91a97ba4ca6bec795f505ada0fa2fc11dc898a159bc2938758c13aef0750d5f9972496eb96b9df5b98eafee94a98b948609411d
- SSDEEP 3145728:zDhnhBE5mHrYcDiCcztU9D3PosjRpAo8tsus1JBTG03x1T5z95:zDFhq5WYptztU90OphSs9DBlBX
- TLSH
  T1E1483362EEA27E51541AC708E1F34786518BF7FBE7E14046D528B6984A510BBCF28CCF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/FileContentIndex/41e4ad34-3cac-4f8c-95e1-e72e40722902.vsidx
- Size 652KB
- SHA256 41f968255c260155da646a1bd0532e206210f338abf64dd03d051e144b5fcba6
- MD5 68eb5e68263e29672b95a2e836780399
- SHA1 39aeeb60a85c3843d9d753fe21e9f2b7d62fd236
- SHA512 c2e0db38a8944d548d687680e401e0e1b25ca949a7a6b309869844ec7fc9a1c0a5633be1b5c03c7b05dab9894a8c3142a016261a8314e52e3ca98fd181ce3ace
- SSDEEP 12288:NKGMmE8W8u1SScVlRxI6PQyo99DKWd7MCee:NKGMByScVzuXT
- TLSH
  T1E4E4C5197BE9F114C432A4BB8FDB9F297B3BE3E893170B1B129592171D073643E4A468
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/.suo
- Size 41KB
- SHA256 250446abf1257a36643980a7d53fe0bc05251de3e10d6d50320e70964d23a29c
- MD5 86683900f53cebf0db24cfdb33232a31
- SHA1 d9ee0dfc77d3d3b88723f2dfa6bd273690661a68
- SHA512 17e1bef964df833a7525bd81e9e6225986226959a5002f6be20acc44fc32232d5ae305015cc194cb53062ed9ed1091e7271d89fef896d8ab0765de4581bbb5b4
- SSDEEP 768:S1T1cgksqP4V1BupECXK0keXkasR8qEe68m:S1T1cX3AV1Bu2CGeUasR8Fe68m
- TLSH
  T10A135A5023F49525F3F68E7579F5D24A283ABD32AC89D53F30A0778D1832B1589A2F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/Browse.VC.db
- Size 53.5MB
- SHA256 030785d9ed0a4fa26d1a23bd404f9b180f1d3fff4c9a8a7c362ddd6bbde4b7a6
- MD5 d744538ac9266d9db0eab2aa256e7b5a
- SHA1 25b108216844db5d581e0473187fa11e088ee1cb
- SHA512 8ef418c5fb5af0a805284dded1e7a7a94c05da16043020c8b2a533f8e90b3868e34c8dcebd9899838ef01ff1ce30dfef5a10e61508d952611a726e2f9f9d8d87
- SSDEEP 786432:Yh4pxZPic0L7r7fHbvQb+lHYmA+xKkrt8mnp402ESAEc8X4cNsezlCrdBx9Ia0O0:Yh6ZPoDX2
- TLSH
  T1F1C72A623A0E8177FDFCC4F77ABF86A42722D998A3D159AB6044037749DD7443A2290F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/DocumentLayout.backup.json
- Size 3KB
- SHA256 5fe2e8a720717cc3577ae6ba53b11c40b7c949c13ddabbc4a9b06a128daf7e39
- MD5 403b5167e48ea9278eb8ded06c7b0af5
- SHA1 fac0da4fa7daf4966877559b04148bb755357d98
- SHA512 c8d3f83fe776a6c8e99aa171139169d2a8b05414358471685966eb0fba6a13ba966d7735b78d101e62b4600119e2d55a0e2aefbe8b8929615350bf2c7e0e99db
- TLSH
  T1BE714675D361A8231A305E1535E48396BCAB633B50DC213B34FC600DBF7AE2A0096E5B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/DocumentLayout.json
- Size 3KB
- SHA256 065ee1896aa610fd551854a2bccd460222356b38d9e2af61c49f692d87506a0f
- MD5 41ffa80962d22314cac253ddb4522bd4
- SHA1 2164b163f7098c0722a30c0c7dfe4ceb06bfe9bd
- SHA512 3414e154732708ea60c0cecf18861ebe995df39288aaf3d80ed224cfa77bfe3b2debd6e8404591df1e1f39c7b613d1d95a6eec8ac055d49f81b0bcb3e0fc4819
- TLSH
  T13C713575D361A8231A305E2575E48396BCEB633B50DC213B34FC600DAF7AE2A0096E5B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/Solution.VC.db
- Size 428KB
- SHA256 fc3fb090d9bc8380172cbadc5b6ed853ab34d2086b748cdb684fbd781fe5c152
- MD5 df149d9a0dc594c0f662d123056fc1cc
- SHA1 df978062baafefdfda819e639331a72fe77720a4
- SHA512 2c497f3f272242972a3c7fd10dc46917b1d43b83b5a15e10f019c3be4fc009cb6842be07c429d518a5b78f18121f26d527887b9a758c925ac7df837ea51f2c94
- SSDEEP 768:3o1U5Xv6FaOLcH8a4nZnLKrCDU5XHQlh7s8mbgA9J:3or
- TLSH
  T1A494CE4F8AACBE52D3E19831C1E26C78FC67529F87B4B6B155B4B1788AC427280F7417
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/fileList.bin
- Size 62KB
- SHA256 27cc229fa4ad815d8cd0be676ae6ddcffb41a00d6a371d0b54c3e22e1d5dea1e
- MD5 992b41821e94820dd75bcd8203ac26c3
- SHA1 45800ab6a4effeef9b9dc31f15094808d9574ddf
- SHA512 1eb7fa38465781eecd4286ba71c21b87e1668c300a75c1458618421e8c11db3e77ece943ee7bb5cd05e3322ea853015c2baab586ef29c818fb7de21a72c1d7d2
- SSDEEP 192:vlyeUU/vv/OHmOEhADs7+iryxa/zeaGdBz/iFP:vIeUon/OGOyEs7ZryM/zeaGdBz/OP
- TLSH
  T17A536D5ACA6DD627DF10FC34B3D15B06219DF651928A933391F08312ECCF2A85BADC69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/ipch/AutoPCH/3fb34e06b59335a2/MAIN.ipch
- Size 273.1MB
- SHA256 e472f2838f66fe1c3cdcd2fd3b405807e1645f6d456fd9acf947ef00a691b1e7
- MD5 9f1cc53334c030a6a1b32a8759c9db51
- SHA1 3d4e8dcc5240e0956a51a667a910376ec64665e4
- SHA512 eb6a4e332d0776cde4b0afc2e9462ff35e99248533826ca6e888f35274a5126b72277e982b61757981f05cac2af01a375fa9e5a3ee7027a4f0db2f56a5d70e94
- SSDEEP 786432:QDY7KPsahamHrkIMpXZhtrGcGXCiFyVQCywXMBgekNeCWOVdsPp9+LeRNC:Os8WVdsPj
- TLSH
  T1CFD80801EB536B66D6A5033059F743A47B38E18E9742572F308CF27D6F6378A2EB2254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/ipch/AutoPCH/542d6b171a25d6e3/IMGUI.ipch
- Size 8.6MB
- SHA256 a74139a8bf724382ad55da28523f9bfb66f556ef5e5440b9253fb79a7aa5ab47
- MD5 d49014d6cbc5e848b2e5120f57ba4541
- SHA1 10f28580ff716f3e00b75cd7095208b5b5a337a2
- SHA512 98659994e59927c2db2f96cfe68bf7f760c5fbe9e72acd8948e3162d3f7fc1af32c0f7ca47c7029be05d3a548d51ace2e6da7215bb7879a1bf4c5f05095df97f
- SSDEEP 98304:/mflfQGB83oBoii5tpOndFosNtj5mkmVpSenIk7gDj3d:/mflfQ48g9+sDj5mkmVpSxj3
- TLSH
  T12796F4256FA3AA67D84D43F08CE65BD83330F6CA8A02435B71AC567D5C663C81DFB285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  FortniteFreeSrc/FortniteFreeSrc/.vs/meow/v17/ipch/AutoPCH/b4ee9e18c0b756e4/IMGUI_DRAW.ipch
- Size 8.1MB
- SHA256 345f2ffa31c17e26c0b47c92bd5bd5996ab1a79096d9f16923240f087d76a77a
- MD5 ec9daab7ac4026e28aa1470d340827ef
- SHA1 5c342716a0aaf00a6149f48287852be1e4dc348b
- SHA512 709b1a8e4507b397d2031fa310dd1310398773e3eef7059e4ba21fb9b34e9493cde006672302a8177f1e051e9b7e9638e540e400ac24db8b8762cf1c615f234c
- SSDEEP 98304:QmfufQhARkTBTu4j1nFIqwznYbtBmnnj:QmfufQhAL5n
- TLSH
  T1E58638696F53AA63D86D43B48CE70BD83330E5CA8B42036774AD15AD5C93BC90CF7686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  FortniteFreeSrc/FortniteFreeSrc/build/D3DCompiler_43.dll
- Size 2.4MB
- SHA256 ffedb064adc25328b24dcf145b04045a867a5574c931516d7845babf2a08937f
- MD5 d010ab113ed06bf6b42c7746ef395e21
- SHA1 5d6b1763f38ffe6d70146e74e9abeae15e3fc35b
- SHA512 0ca4656d0ea2af368b0f667dcfbbc819f8f1209cebba3e5a2bceb9b235e5443eb0452f0f0c3970b419fe6199d4d7cb7390a1f9cd46b689954f8e58ba9d0c2b9e
- SSDEEP 49152:wf59zPxKcvHzDB6t3+C0/aJfyLg7Ie4Xy+5j4m2CTv:92642o7lftT
- TLSH
  T13EC56C46B6A080F9C6AB81748A975703FBB0781403245BDB5160E6652FB7FF26E3F724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  FortniteFreeSrc/FortniteFreeSrc/build/HyperZone.exe
- Size 631KB
- SHA256 273228a3f6f7cde29bc99ffd764096448425afbb31f6342b1326e70ab5e9c5f3
- MD5 963f1cc33d286d7d6d4c416b607839e5
- SHA1 650c403ff82e31f593d7a0129b393c59a697c33d
- SHA512 dc17aab9e4e1d474b4334078fe4124cd025b7140ff8dec975ce8b705044fda174d17bee7e587420ea75a069a6f24ee072e476363c916c6d4c827e916d4cd3fdf
- SSDEEP 12288:0JId9lz7gPV6SBXmn0TjzOjuMscY5KbTzE5y+6:HdGV6Shmn0TjzOtNYy
- TLSH
  T180D4AE46F1A815F8D07BE17D91A7930BD57238498B328BCF23D806892F537E466BB352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  FortniteFreeSrc/FortniteFreeSrc/build/d3dx10_43.dll
- Size 502KB
- SHA256 b5f2e4d842c758fae91323888ace39328c47d9546231757f73831e2369ae58ed
- MD5 190649d410964753a54a306caeb33cb8
- SHA1 b45752e0558a9b0b70a9b490e8a7148b807a4f42
- SHA512 8321a42608947bdca156b48c019b999d01aaea6a558026493b42ca54c18b1f3eb7d0d343c998af16fd27dea63fff662c2f645962e261aec0fa04d8fcb72b92fe
- SSDEEP 6144:dIHyAfFvQet8lzb3f3+UHWIVPfkKS7GXzeARN85BwC5uhFcuiZyoO2uwpapnlJRX:aNFoet8lzbv17VPfkKS78zBN8LgIappX
- TLSH
  T1A0B4484132B8D6E6F13D653CB0AAF60BFA3135180B2046CB56B49069EF66BC44EFE715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  FortniteFreeSrc/FortniteFreeSrc/build/d3dx11_43.dll
- Size 273KB
- SHA256 25814402ce1d74f198958aa38661242189b4e5d640177087d0ba0ecf65d19a44
- MD5 015743813e8d70a91cce6319fd2ec94a
- SHA1 14c224c566a28168be62de535445d527a1156f01
- SHA512 163971668c8d34baccd6cd526b589b91792a2a6437ceebfb9080e2c98d0e33a59c9f084f98ccc2f117b872836407595b6166b09f3830b4875036db95ec2aef5f
- SSDEEP 3072:FCWVWFOaVgP7BzvjYlTc91N6Vkg4eK6DvDBcMqpcJbMYBu1+Iz54+vJds:/Ww4gPdz7YlTc91i1DLopYMvIIhs
- TLSH
  T1C0546B5237899CDBE4B9A83CD0EBA203E3F1F5950B60D6CB0260455DAE7B7D09E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  FortniteFreeSrc/FortniteFreeSrc/build/d3dx9_43.dll
- Size 2.3MB
- SHA256 36b84dfa0ef9d3ff3549a7ad54d2a8032bd22c879219ee1a959137c4ef8786c4
- MD5 460d2b03615d8c0697721ce26aee1e60
- SHA1 e2dbd56d24cd783fb3c4bc2b527665623fb6435c
- SHA512 7d2a6c0593269aa74af6e53ffaede1e805c795410f97c5eeef6f4963e3e5785d02db81630758747dfa6bad60082ec1e118869b27f3f6995e11d9f592956d5b2f
- SSDEEP 49152:2bCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nI:1IIBnI
- TLSH
  T101B5486172F4C1E4E3269039B597B20BFAB1304907188BC793E04D9A5FE6BD86CFA355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32