Extracted

• • Target
    xsetfortniteoptimization_sideloader (2).zip
  • Size 11.6MB
  • SHA256 fb551c366957d12d9b7aec0d36d2f7cee529a318c240c56c0e67441330bc2cfd
  • MD5 4cf8dd84e7a4ff26f22893e677a99507
  • SHA1 ef645b78657a933b27b58b1c2b847b4d53144713
  • SHA512 f3e7466c57bea22b45b154ca6ffd35b263f48abadd44392a77f55edc3855fa2cdbf0273bef93b8b77d3b9595e2de0e3dddcd588d8868859fd3394cc4d779724a
  • SSDEEP 196608:8vjpHbHKwkHouSxch5+jeJcIH00y9/9iIoa3Ruq4bij75dKxx/:2pHTKpI7cbJcoDOR3mY75Axx/
  • TLSH
    T1B3C6335F9AD0AFCAD11B43A4A9EC0517C7F0929F8B848EBA5CC13766F11E099946FCD0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealeradwareransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  behavioral1behavioral2