analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://amd.hackprogram.win/2017/fortnite-hack-toolcheat-v1-2-9-esp-aimbot-free-undetected-pc-ps4-xbox/

Full analysis: https://app.any.run/tasks/2c43997f-d3dc-4a28-9427-0987b84d3eb0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 14, 2019, 04:57:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
adware
installcore
pup
Indicators:
MD5:

3044D17E5F0239C5B181FDDD4C949A72

SHA1:

2E60BA9AD94AC796E1036C13B4A92FAD8E1A5E86

SHA256:

5D38FBCC56CEF73B30C20064B3E6156735A7099BBA3B38C2CA40CA6C9763E4F9

SSDEEP:

3:N1KfGWfRLDM4DMRLQtNvnRe0e5S6KdtQLnGRjGItdqI:C5RXQRONvE0e5SHdtQiRjGuqI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_4212905281.exe (PID: 2516)
      • setup_4212905281.exe (PID: 3464)
      • setup.exe (PID: 3988)
    • Downloads executable files from the Internet

      • chrome.exe (PID: 3860)
    • INSTALLCORE was detected

      • setup_4212905281.exe (PID: 3464)
    • Connects to CnC server

      • setup_4212905281.exe (PID: 3464)
    • Loads dropped or rewritten executable

      • chrome.exe (PID: 1048)
      • setup.exe (PID: 3988)
  • SUSPICIOUS

    • Cleans NTFS data-stream (Zone Identifier)

      • setup_4212905281.exe (PID: 2516)
    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3860)
      • chrome.exe (PID: 1248)
      • setup.exe (PID: 3988)
      • setup_4212905281.exe (PID: 3464)
    • Application launched itself

      • setup_4212905281.exe (PID: 2516)
    • Starts Internet Explorer

      • setup_4212905281.exe (PID: 3464)
    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1248)
    • Reads internet explorer settings

      • setup_4212905281.exe (PID: 3464)
    • Reads Environment values

      • setup_4212905281.exe (PID: 3464)
    • Creates files in the user directory

      • setup_4212905281.exe (PID: 3464)
      • setup.exe (PID: 3988)
    • Creates a software uninstall entry

      • setup.exe (PID: 3988)
    • Creates COM task schedule object

      • setup.exe (PID: 3988)
    • Creates files in the program directory

      • setup.exe (PID: 3988)
  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 1248)
      • chrome.exe (PID: 3860)
    • Reads Internet Cache Settings

      • chrome.exe (PID: 1248)
    • Application launched itself

      • chrome.exe (PID: 1248)
      • iexplore.exe (PID: 2452)
    • Changes internet zones settings

      • iexplore.exe (PID: 2452)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3580)
    • Creates files in the user directory

      • iexplore.exe (PID: 3580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
38
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs setup_4212905281.exe no specs chrome.exe no specs #INSTALLCORE setup_4212905281.exe chrome.exe no specs setup.exe iexplore.exe iexplore.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1248"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://amd.hackprogram.win/2017/fortnite-hack-toolcheat-v1-2-9-esp-aimbot-free-undetected-pc-ps4-xbox/"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2488"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6ed2a9d0,0x6ed2a9e0,0x6ed2a9ecC:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3664"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1780 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1060,1236811904945844624,4354228354654112906,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=2858843561962537388 --mojo-platform-channel-handle=1032 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1060,1236811904945844624,4354228354654112906,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=4321023856890630157 --mojo-platform-channel-handle=1548 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1060,1236811904945844624,4354228354654112906,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11149264283027598520 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2864"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1060,1236811904945844624,4354228354654112906,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3182324429230919108 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
1160"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1060,1236811904945844624,4354228354654112906,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1000427962656894486 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1060,1236811904945844624,4354228354654112906,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6939588548868096404 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3324"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1060,1236811904945844624,4354228354654112906,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14412379031296435298 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
2 555
Read events
2 333
Write events
215
Delete events
7

Modification events

(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:Key:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:1248-13215502647623750
Value:
259
(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1248) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:1512-13197841398593750
Value:
0
(PID) Process:(1248) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
35
Suspicious files
123
Text files
356
Unknown types
29

Dropped files

PID
Process
Filename
Type
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\fbefc9b3-f05d-4129-82ba-60523aaf9dc0.tmp
MD5:
SHA256:
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp
MD5:
SHA256:
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:A519780ED0A2F4336DB4F5651D79C369
SHA256:DA5B71BD0075B55757BF757BF5F4D4A1DCBCF0762CDA5B31B28680963E068C75
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:DC32343F45B01764B6267AD36548102A
SHA256:A250F5AD57D4BD58AAE92810D50278E3BE2DBF869F126A3A3519691BCDFC2075
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF39ab00.TMPtext
MD5:A519780ED0A2F4336DB4F5651D79C369
SHA256:DA5B71BD0075B55757BF757BF5F4D4A1DCBCF0762CDA5B31B28680963E068C75
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30
SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF39aab2.TMPtext
MD5:DC32343F45B01764B6267AD36548102A
SHA256:A250F5AD57D4BD58AAE92810D50278E3BE2DBF869F126A3A3519691BCDFC2075
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old
MD5:
SHA256:
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
MD5:
SHA256:
1248chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF39aab2.TMPtext
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30
SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
120
DNS requests
71
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3860
chrome.exe
GET
200
104.28.28.3:80
http://amd.hackprogram.win/wp-content/themes/larryslist/include/custom.css?ver=5.1.2
US
suspicious
3860
chrome.exe
GET
200
104.28.28.3:80
http://amd.hackprogram.win/wp-content/themes/larryslist/js/imagebox.js?ver=5.1.2
US
text
301 b
suspicious
3860
chrome.exe
GET
200
104.28.28.3:80
http://amd.hackprogram.win/wp-content/uploads/2017/11/FORTNITE-HACK-TOOLCHEAT-v1.2.9-ESP-AIMBOT-FREE-UNDETECTED-PC-PS4-XBOX-768x432.jpg
US
image
43.8 Kb
suspicious
3860
chrome.exe
GET
200
104.28.28.3:80
http://amd.hackprogram.win/wp-content/themes/larryslist/style.css?ver=5.1.2
US
text
7.50 Kb
suspicious
3860
chrome.exe
GET
200
5.189.179.53:80
http://fileice.us/buttons/windows.png
DE
image
11.4 Kb
unknown
3860
chrome.exe
GET
200
5.189.179.53:80
http://fileice.us/buttons/mac.png
DE
image
13.1 Kb
unknown
3860
chrome.exe
GET
200
104.28.28.3:80
http://amd.hackprogram.win/wp-includes/js/wp-embed.min.js?ver=5.1.2
US
text
753 b
suspicious
3860
chrome.exe
GET
200
104.28.28.3:80
http://amd.hackprogram.win/wp-content/themes/larryslist/include/images/default-header.jpg
US
image
19.5 Kb
suspicious
3860
chrome.exe
GET
200
5.189.179.53:80
http://winfiles.us/Scan.gif
DE
image
34.4 Kb
malicious
3860
chrome.exe
GET
200
104.28.28.3:80
http://amd.hackprogram.win/2017/fortnite-hack-toolcheat-v1-2-9-esp-aimbot-free-undetected-pc-ps4-xbox/
US
html
8.63 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3860
chrome.exe
172.217.18.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3860
chrome.exe
216.58.207.40:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3860
chrome.exe
5.189.179.53:80
fileice.us
Contabo GmbH
DE
unknown
3860
chrome.exe
104.28.28.3:80
amd.hackprogram.win
Cloudflare Inc
US
shared
192.0.77.48:443
s.w.org
Automattic, Inc
US
suspicious
3860
chrome.exe
172.217.18.174:443
www.youtube.com
Google Inc.
US
whitelisted
172.217.22.6:443
static.doubleclick.net
Google Inc.
US
whitelisted
3860
chrome.exe
192.0.77.48:443
s.w.org
Automattic, Inc
US
suspicious
3860
chrome.exe
172.217.18.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3860
chrome.exe
172.217.22.6:443
static.doubleclick.net
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
amd.hackprogram.win
  • 104.28.28.3
  • 104.28.29.3
suspicious
clientservices.googleapis.com
  • 172.217.18.163
whitelisted
accounts.google.com
  • 216.58.206.13
shared
www.googletagmanager.com
  • 216.58.207.40
whitelisted
s.w.org
  • 192.0.77.48
whitelisted
fileice.us
  • 5.189.179.53
unknown
www.admyhack.us
unknown
www.7-zip.org
  • 159.65.89.65
whitelisted
www.youtube.com
  • 172.217.18.174
  • 172.217.23.142
  • 216.58.206.14
  • 172.217.23.110
  • 216.58.208.46
  • 172.217.16.142
  • 172.217.22.78
  • 172.217.22.110
  • 216.58.210.14
  • 172.217.16.206
  • 172.217.23.174
  • 172.217.21.206
  • 216.58.205.238
  • 172.217.21.238
  • 172.217.22.14
whitelisted
mobdroid.shade.lv
  • 173.214.176.75
unknown

Threats

PID
Process
Class
Message
3860
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3860
chrome.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3464
setup_4212905281.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
3464
setup_4212905281.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
3464
setup_4212905281.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M4
3464
setup_4212905281.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3
3464
setup_4212905281.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
3464
setup_4212905281.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
3464
setup_4212905281.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1 ETPRO signatures available at the full report
No debug info