FortniteCheat2026FREE_build.zip
- SHA256 1ebcdf1fb3b706b68839986900e0a22046c7ac83abd0f0f361eca1eb9ef1a0c9
Behavioral task
behavioral1
Sample
FortniteCheat2026FREE.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target FortniteCheat2026FREE_build.zip
- Size 33KB
- Sample261112-cmcbhsch97
- SHA256 1ebcdf1fb3b706b68839986900e0a22046c7ac83abd0f0f361eca1eb9ef1a0c9
- MD5 4bbab3ca7aa06e084857d2cb1fc286a8
- SHA1 a7e670b8fbb681bb4a7e7e73d773edffdd12edf3
- SHA512 65bc2901add1b448a79666939b3c0a5e294d4f01d9ef0bf2509602d38cfd9aefc7be6a1ce75c265bcba39ab351a5dd752e956d0484e11f0141f5b255343ff4ff
- SSDEEP 768:njOgQRLo3o/76WL4SkVybbHTfspKh6LF4MiGqjzlLmHvIphgSsrGAdWnYd:nagQRLo3o/2WgVyg6A4MvqjzBphgvrGO
- TLSH T1A3F2F1A98D9D6CA32142DB8CCEB236744037CEC25B86A5C63A5C740ECF64A254790DFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule static1/unpack001/FortniteCheat2026FREE.exe family_darksiderat - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FortniteCheat2026FREE.exe
File Explorer
-
FortniteCheat2026FREE_build.zip.zip .js 33KB
-
FortniteCheat2026FREE.exe.exe 87KB
FortniteCheat2026FREE.exe
- IMPHASH d2197c92ed2666bd180912a2080f3632
- SHA256 9c838f934d043ffac17d3d56fcaf840b6c9260a891ded96873482786d00d2f03
- MD5 8a5c42b40cf254d65f5b7ba7c77a417a
- SHA1 81d2dabe0a1649efc6293d41dc531e5c9792d738
- SHA512 83583fb9059d272a452337eda45fa0e75e2950da6844a6f801348a65934f9ca09f4fdd3fbc980f4f5a146299e2eadfed2f45646557c16e11fc2ccb6fac9b183f
- SSDEEP 1536:pHPrWXuuVbBSqAM2epomTcq7JDjolYu1l/:NPrWeuV8FMdd2P
- TLSH T1C893D635CAA9B12ED216D478ED464C06DE23B8AE8651BF676BC24DC50FD6F602F2C4D0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DarkSideRAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
WSAStartup
crypt32
CryptStringToBinaryA
kernel32
TerminateProcess
ReleaseSRWLockExclusive
GlobalMemoryStatusEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
AcquireSRWLockExclusive
GetStartupInfoW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Xout_of_range@std@@YAXPEBD@Z
dxgi
CreateDXGIFactory
wininet
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
memmove
__current_exception_context
__current_exception
memset
memcpy
memcmp
__std_exception_copy
__std_exception_destroy
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
_callnewh
free
_set_new_mode
malloc
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_exit
exit
_register_thread_local_exe_atexit_callback
_initterm
_cexit
_register_onexit_function
_initterm_e
terminate
_get_narrow_winmain_command_line
_c_exit
_initialize_onexit_table
_set_app_type
_initialize_narrow_environment
_invoke_watson
_configure_narrow_argv
_seh_filter_exe
_crt_atexit
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=29, id=261, version=35207,
count=6, id=257, version=35207,
count=114, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=1, id=265, version=35223,
count=1, id=255, version=35223,
count=1, id=258, version=35223,