001cc8fb09d14f26b0e488271b1ca034bdc229cc8ce1e4ae1b2cccb6c76d13dd

General

Target
Fortnite-Skin-Changer.exe
Size 26.8MB
Sample260710-3s7byshz3v
SHA256 001cc8fb09d14f26b0e488271b1ca034bdc229cc8ce1e4ae1b2cccb6c76d13dd
MD5 419ef93d5bcdc964fc9b7583b109d425
SHA1 5c71ce433adf5fb6b4ef12ca2648331f7fc93cb8
SHA512 1d205f7e216868af948b67957c1ca6ebc8b38ce0309685e616fa163b51bf72ea01180b5744d94e57159247ea54017dfb7ee602d321279cc2faa1dde3a3afb75c
SSDEEP 786432:3znxv2JLW/1k8kOZY7y1UerLXSVypUSPZf:Dndd1kV7UUG3pUQZf
TLSH
T1D05733AE53B008AFD93B4539A6799073D3B278241721C8DF0FC4573A2E576DB487A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Fortnite-Skin-Changer.exe
- Size 26.8MB
- SHA256 001cc8fb09d14f26b0e488271b1ca034bdc229cc8ce1e4ae1b2cccb6c76d13dd
- MD5 419ef93d5bcdc964fc9b7583b109d425
- SHA1 5c71ce433adf5fb6b4ef12ca2648331f7fc93cb8
- SHA512 1d205f7e216868af948b67957c1ca6ebc8b38ce0309685e616fa163b51bf72ea01180b5744d94e57159247ea54017dfb7ee602d321279cc2faa1dde3a3afb75c
- SSDEEP 786432:3znxv2JLW/1k8kOZY7y1UerLXSVypUSPZf:Dndd1kV7UUG3pUQZf
- TLSH
  T1D05733AE53B008AFD93B4539A6799073D3B278241721C8DF0FC4573A2E576DB487A760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery lateral_movement persistence privilege_escalation ransomware spyware stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- OS Credential Dumping: Security Account Manager
  Malicious Registry Hive Dumping.
  credential_access
- Remote Service Session Hijacking: RDP Hijacking
  Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
  lateral_movement
- Modifies Windows Firewall
  defense_evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Password Policy Discovery
  Attempt to access detailed information about the password policy used within an enterprise network.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2