682ad648981c491dd731970f8314963dcdd329d3764b3afb2d430e42258f554a

Sharing

Copy URL Twitter E-mail

General

Target
Fortnite-External-master.zip
Size 6.0MB
Sample260731-3klehsae25
SHA256 682ad648981c491dd731970f8314963dcdd329d3764b3afb2d430e42258f554a
MD5 1e851e4afcec5c10dfd5d23083da1553
SHA1 3549ffb9eb2f187185d9b95440b95f359234caa7
SHA512 d7418f0308be1dcc78cece7b38798bc4db459018331e0ae0e2a197646f0570a8ac9d4fc621a9b261d370d7a2bb8c18fd50f16c69a71b1369382b49ef645273cd
SSDEEP 196608:8LRBIkvAuuq0EeR5BSxfekPFMOPYBEF2bTrEr:+LjTuq0B5qfHMBBQmTri
TLSH
T1A25633BBF1BB9BA4E6B7B2BDD30390026FB8C0438DD6B7B547918574C96B80D06E5448
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  Fortnite-External-master.zip
- Size 6.0MB
- SHA256 682ad648981c491dd731970f8314963dcdd329d3764b3afb2d430e42258f554a
- MD5 1e851e4afcec5c10dfd5d23083da1553
- SHA1 3549ffb9eb2f187185d9b95440b95f359234caa7
- SHA512 d7418f0308be1dcc78cece7b38798bc4db459018331e0ae0e2a197646f0570a8ac9d4fc621a9b261d370d7a2bb8c18fd50f16c69a71b1369382b49ef645273cd
- SSDEEP 196608:8LRBIkvAuuq0EeR5BSxfekPFMOPYBEF2bTrEr:+LjTuq0B5qfHMBBQmTri
- TLSH
  T1A25633BBF1BB9BA4E6B7B2BDD30390026FB8C0438DD6B7B547918574C96B80D06E5448
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Fortnite-External-master/driver loader/DriverMapper/main.cpp
- Size 1KB
- SHA256 105f333eebc609d7cc53ded831a36b4d50920afefd94666781c4cb104973bd60
- MD5 3e9e64c091e1c1ab53f0f4534a84d17a
- SHA1 efb8661e705ca88085b4b9ad0dc5161726aa123b
- SHA512 9e6bd2425a88624afd18010310c0e95b814aaa6726b31bb4e2f094458241b4df07983aafc1de3700c041c2b41ebcb576f10caf0cffc68b7f33b158bbff385e7f
- TLSH
  T10A21C112FA5FA14B5CB654CD843304894E95E1782BB5927294E830EDF0EE42EF3231B7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Fortnite-External-master/driver loader/x64/Release/DriverMapper.exe
- Size 84KB
- SHA256 ee4d3a836b14f5a2e97781797b47d1a7194424c9c10b48ef3df9377182b99e00
- MD5 72ea3b5b21a6989fe27794ed49799795
- SHA1 dc1cc9eb9747469f19dffd6656c4a688948f2c59
- SHA512 9d52eae6752fe1024cc01d09c8b86121d82a4a440c110df7c741f0f960086a73a5a5fac18d570f2d5c43859101394efdb438f4fbb8d222d1a5a2e12ed85d81a4
- SSDEEP 1536:/K2hmkKbDEgRzcf6oIA+CAwNai+IpMe/2subBfW6Qoutcp:/KmKPEQcioIBCANiMe/QbI6QoR
- TLSH
  T1E3835A5B7B5505ECE1A7E238DED75782E3B274050B2117CF1781826A1FB7AC0AE3BA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Fortnite-External-master/kernel rpm/dummy/output/x64/Release/Inject.sys
- Size 8KB
- SHA256 006ee5498caeee99c3ee5955360242ab7098afb9cbf3763d4d92a8ed36fdee0f
- MD5 7bac6761c4ed81d8dcd22649e945bfe0
- SHA1 3b9f623d5238f8b4eac11c494885822b78fcdcec
- SHA512 7fd824bc8ccde3c87081fb621c49d47e12db7045ef22a407c4d8968546500d5fd61fa9b82b16a25a817b6ae6805d1057fa2190ae6333c957f61a29e2d627f45d
- SSDEEP 192:uNLEdM1270T7+qdp1x9GTDUHzZh+TSnzpA2E9:uL1C0TJPgsHGTOE9
- TLSH
  T163F12A66728305E1C26DA5F8CC5D40B5DBD9710923538ADF4701CDBC0A73ED4BA36626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Fortnite-External-master/kernel rpm/dummy/output/x64/Release/berkeley.cod
- Size 29KB
- SHA256 a654d6888e0e8bec8a0b3c0145e091cc4788a06dfa760c795bf9ab03931eeff2
- MD5 54e53188d9556c6c203f792b805830a0
- SHA1 aaa59312bb5f5bb860c69f5daa2edbe9e3ae998e
- SHA512 0a67fda1987a38442de55b0438654e688bd06cd7c882f4f07f59bf1fa50b9f9cd216abee50cee58ab6cddaa1a79dbda943b37f1e9bc70f07c55455735599332a
- SSDEEP 768:AoreeHi4w3L0U0VIU4Xhh6O4GGXxZRkk7e4GGX4GXbnbCU+KWKW6Gaa4X4X4XYfh:ri4w3L0U0V0aK
- TLSH
  T180D27284A1EA4181F530A14EAF91B4688B9CFE0B4BE44170F5BC9FD1B7B4E4562B787C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  Fortnite-External-master/kernel rpm/dummy/output/x64/Release/dummy/Inject.sys
- Size 8KB
- SHA256 006ee5498caeee99c3ee5955360242ab7098afb9cbf3763d4d92a8ed36fdee0f
- MD5 7bac6761c4ed81d8dcd22649e945bfe0
- SHA1 3b9f623d5238f8b4eac11c494885822b78fcdcec
- SHA512 7fd824bc8ccde3c87081fb621c49d47e12db7045ef22a407c4d8968546500d5fd61fa9b82b16a25a817b6ae6805d1057fa2190ae6333c957f61a29e2d627f45d
- SSDEEP 192:uNLEdM1270T7+qdp1x9GTDUHzZh+TSnzpA2E9:uL1C0TJPgsHGTOE9
- TLSH
  T163F12A66728305E1C26DA5F8CC5D40B5DBD9710923538ADF4701CDBC0A73ED4BA36626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Fortnite-External-master/kernel rpm/dummy/output/x64/Release/dummy/WdfCoinstaller01009.dll
- Size 1.6MB
- SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
- MD5 4da5da193e0e4f86f6f8fd43ef25329a
- SHA1 68a44d37ff535a2c454f2440e1429833a1c6d810
- SHA512 b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
- SSDEEP 24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
- TLSH
  T10485234577FC1178F1F3AAB48ABA84062A767C854FB6D28F0250C95D6DB2FC489B4363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Fortnite-External-master/loader/DriverMapper.exe
- Size 84KB
- SHA256 ee4d3a836b14f5a2e97781797b47d1a7194424c9c10b48ef3df9377182b99e00
- MD5 72ea3b5b21a6989fe27794ed49799795
- SHA1 dc1cc9eb9747469f19dffd6656c4a688948f2c59
- SHA512 9d52eae6752fe1024cc01d09c8b86121d82a4a440c110df7c741f0f960086a73a5a5fac18d570f2d5c43859101394efdb438f4fbb8d222d1a5a2e12ed85d81a4
- SSDEEP 1536:/K2hmkKbDEgRzcf6oIA+CAwNai+IpMe/2subBfW6Qoutcp:/KmKPEQcioIBCANiMe/QbI6QoR
- TLSH
  T1E3835A5B7B5505ECE1A7E238DED75782E3B274050B2117CF1781826A1FB7AC0AE3BA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Fortnite-External-master/loader/rpm.sys
- Size 8KB
- SHA256 006ee5498caeee99c3ee5955360242ab7098afb9cbf3763d4d92a8ed36fdee0f
- MD5 7bac6761c4ed81d8dcd22649e945bfe0
- SHA1 3b9f623d5238f8b4eac11c494885822b78fcdcec
- SHA512 7fd824bc8ccde3c87081fb621c49d47e12db7045ef22a407c4d8968546500d5fd61fa9b82b16a25a817b6ae6805d1057fa2190ae6333c957f61a29e2d627f45d
- SSDEEP 192:uNLEdM1270T7+qdp1x9GTDUHzZh+TSnzpA2E9:uL1C0TJPgsHGTOE9
- TLSH
  T163F12A66728305E1C26DA5F8CC5D40B5DBD9710923538ADF4701CDBC0A73ED4BA36626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  Fortnite-External-master/loader/sdbus.sys
- Size 278KB
- SHA256 76816b302db4d0b91fc8dee6643c9839a48812df1ee7d34100134550184aa2cb
- MD5 1f58e6d5c1f211de8bf5131bf12077d1
- SHA1 031e3a45bff215edce3f0b76c1810be06a720b65
- SHA512 b28752fdb5a039166386d15f4e3ee09c1f84be08b2f99f8c310ba298a51090911ca0e20df38c7ab0558361b751ee05e30bf559041d92e08fc35dd7b7452724c4
- SSDEEP 6144:xGz+4LS5txXWksnIeEUZcvsML7dMOZFBQzTqRo+YSoIDl1HrMxBm3:xUuWTItDpjZFBQzTiT1LM7m3
- TLSH
  T121544A5667F42C69E8B7C4788AA6D507E7B579051B72E3CF11F095482F23BF0A83432A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  Fortnite-External-master/loader/start.bat
- Size 34B
- SHA256 3846a421801d3d689c156f2e70b7562a4ae94099163df9cc8331d9861af26371
- MD5 2d12b1037100136009d122f67c505ef4
- SHA1 756a5b77dc764f0a49dd9bb773959bc3de173475
- SHA512 1c345522d575184c7dc49bc2d6bf6f473a49741ad4e89526867bae2836f8e7a4c4ff0c453009aa0e4ee2fdf53b2fef7d7b5566a3ae2785dbe2d9dbc0cb66794b
- MD5 SHA1 SHA512
Score

8^/10

execution persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral17 behavioral18