General
- Target Z1RO FORTNITE.rar
- Size 457KB
- Sample261023-s3bb6acv2v
- SHA256 bc8a3c6b80442788cc293df7503ea6a4963f8ec8d196a1ad2d3f73479a3364a5
Score
8/10
Malware Config
Targets
-
- Target Z1RO FORTNITE/Z1RO FREE.exe
- Size 803KB
- SHA256 687998ce267b7952a6df3b0c8841976d381e883fc8522f04c356144d23584635
Score8/10-
Drops file in Drivers directory
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Z1RO FORTNITE/nigctl.sys
- Size 29KB
- SHA256 927893280567a079a910cabb2035d65db67b7937674a354d147a322ee2c4b455
Score3/10 -
- Target Z1RO FORTNITE/timeless-mapper (1).exe
- Size 58KB
- SHA256 6f73e0c1edb6966caf5be85ab3fc6c61fe2fba47b8118ea99349cbd72c2ae5ac
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1