| File name: | Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe |
| Full analysis: | https://app.any.run/tasks/8ea0a7b7-8e4f-4e1f-922d-5417232f38c6 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | March 16, 2025, 22:46:37 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections |
| MD5: | 10E2E1D6446135B4B0EFA284EE5E2F3D |
| SHA1: | F0D43421CD7C74597F02CA77BE0B4C0B8B489485 |
| SHA256: | F8C306717404E547EB3B33AC8B4C50EA9DD828E72DBD661E36608C82F4A1DC7B |
| SSDEEP: | 98304:H+QqZ8fOerIXe0eZWI1O4dmt7DCEpzGbRjtL4olDX3hd9p1pKGRsLQC9KA+iCIcb:zTz7CMI/s |
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:11:15 09:48:30+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741376 |
| InitializedDataSize: | 157184 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.4.1.0 |
| ProductVersionNumber: | 1.4.1.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | Linkvertise GmbH & Co. KG |
| FileVersion: | 1.4.1 |
| LegalCopyright: | |
| OriginalFileName: | |
| ProductName: | Linkvertise GmbH & Co. KG |
| ProductVersion: | 1.4.1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 732 | "C:\Users\admin\AppData\Local\Temp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe" | C:\Users\admin\AppData\Local\Temp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | explorer.exe | ||||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Linkvertise GmbH & Co. KG Exit code: 1 Version: 1.4.1 Modules
| |||||||||||||||
| 2980 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3332 | "C:\Users\admin\AppData\Local\Temp\is-E68TU.tmp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmp" /SL5="$B028A,1793745,899584,C:\Users\admin\AppData\Local\Temp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe" | C:\Users\admin\AppData\Local\Temp\is-E68TU.tmp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmp | — | Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 3888 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6392 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | GlobalUserOffline |
Value: 0 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143 |
| Operation: | write | Name: | 1768776801 |
Value: 153 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143 |
| Operation: | write | Name: | -757413694 |
Value: 0 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143 |
| Operation: | write | Name: | 1011363107 |
Value: 0 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143 |
| Operation: | write | Name: | -1514827388 |
Value: 35 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143 |
| Operation: | write | Name: | 253949413 |
Value: 302 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143 |
| Operation: | write | Name: | 2022726214 |
Value: 0800687474703A2F2F627573696E65636573736974792E636F6D2F6C6F676F2E67696600687474703A2F2F616C2D736F6D6F772E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F616D6E69737572652E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F62686167617661746972616E6E6164652E6F72672F6C6F676F2E67696600687474703A2F2F616E6B6172612D63616D62616C6B6F6E2E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F616F63756F696B68616E686C696E682E766E2F696D616765732F6C6F676F2E67696600687474703A2F2F79656E692E616E74616C796168696C616C2E636F6D2F6C6F676F2E67696600687474703A2F2F6172696D616578696D2E636F6D2F6C6F676F2E676966 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143 |
| Operation: | write | Name: | -503464281 |
Value: 96D3CDDE1C47B6A5FC358E558DE5299650540F2D50E5B087B8550A1861A21FDD2D08CFD143520423640DF1B597E13A5AA874C82897D59B5DC0680E58CE7259E3740BA29EE6BB43137ECE07AEF1C391CF0D6BDB7CAFE72C3B3933EF3874B3E349C7516230896C2320F5AD567F594746C1E5F1686CDF8A85051E8105B44B94E21E | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp |
| Operation: | write | Name: | a1_0 |
Value: 159343150 | |||
| (PID) Process: | (732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Aaspp |
| Operation: | write | Name: | a2_0 |
Value: 6759 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 732 | Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | C:\Users\admin\AppData\Local\Temp\0010B817_Rar\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | executable | |
MD5:10E2E1D6446135B4B0EFA284EE5E2F3D | SHA256:F8C306717404E547EB3B33AC8B4C50EA9DD828E72DBD661E36608C82F4A1DC7B | |||
| 732 | Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe | C:\Users\admin\AppData\Local\Temp\is-E68TU.tmp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmp | executable | |
MD5:45E61D4831803F7B07D8FA633F26DD55 | SHA256:FAAD724F850B2850BC0979F8DB1450252D72EC3FBF40DEBB2EABCF5E27EEAF1D | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6584 | SIHClient.exe | GET | 200 | 104.115.34.42:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6584 | SIHClient.exe | GET | 200 | 104.115.34.42:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 88.221.110.122:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.110.122:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 88.221.110.122:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 88.221.110.122:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.67:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6620 | backgroundTaskHost.exe | 20.103.156.88:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6620 | backgroundTaskHost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |