General
-
Target
Astro Fortnite Free Loader.exe
-
Size
14.4MB
-
Sample
240701-p5jvjasfme
-
MD5
c284115e08a73e4efd15e6e5cb3ca43e
-
SHA1
f054f448b26d0d771ad46221790dd7f4930cc428
-
SHA256
d684f65afeaf36f09228552a6a3c76c53ac2e9affb10dded7c8727656ad71ed3
-
SHA512
92713ba56f8343e74789ff37dbbede91cb778d76e637e34af884a579d7aa0667fdc4aa2af4a2e2d3b3dbb90f700e1be76966402a8605378db7637719d903fc0e
-
SSDEEP
393216:16wSPvI+HcfkP/K6gwoUTJtiY7o+WwIXh:16zPvXcfcy6g0TDPxMXh
Static task
static1
Behavioral task
behavioral1
Sample
Astro Fortnite Free Loader.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Astro Fortnite Free Loader.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
Astro Fortnite Free Loader.exe
-
Size
14.4MB
-
MD5
c284115e08a73e4efd15e6e5cb3ca43e
-
SHA1
f054f448b26d0d771ad46221790dd7f4930cc428
-
SHA256
d684f65afeaf36f09228552a6a3c76c53ac2e9affb10dded7c8727656ad71ed3
-
SHA512
92713ba56f8343e74789ff37dbbede91cb778d76e637e34af884a579d7aa0667fdc4aa2af4a2e2d3b3dbb90f700e1be76966402a8605378db7637719d903fc0e
-
SSDEEP
393216:16wSPvI+HcfkP/K6gwoUTJtiY7o+WwIXh:16zPvXcfcy6g0TDPxMXh
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-