Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping_EAC.exe
- '<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping_BE.exe
- '<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping.exe
- '<SYSTEM32>\taskkill.exe' /f /im EpicGamesLauncher.exe
- '<SYSTEM32>\taskkill.exe' /f /im FortniteLauncher.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllYDbg'
- ClassName: '', WindowName: 'The Wireshark Network Analyzer'
Modifies file system
Creates the following files
- <DRIVERS>\ee.sys
- nul
Deletes the following files
- <DRIVERS>\ee.sys
Network activity
Connects to
- 'localhost':49186
- 'localhost':49188
- 'ab###panel.xyz':443
- 'localhost':49191
- 'localhost':49193
TCP
Other
- 'localhost':49186
- 'localhost':49188
- 'localhost':49189
- 'ab###panel.xyz':443
- 'localhost':49191
- 'localhost':49193
- 'localhost':49194
UDP
- DNS ASK ab###panel.xyz
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'cheatengine-x86_64-SSE4-AVX2.exe'
- ClassName: '甀湪牮' WindowName: ''
- ClassName: '瀀潲硥' WindowName: ''
- ClassName: '燎' WindowName: ''
- ClassName: '切' WindowName: ''
- ClassName: '砀牰o' WindowName: ''
- ClassName: 'ਊ†††††††††††††††††††††††††䌠湯敮瑣湩⸮' WindowName: ''
- ClassName: '縷' WindowName: ''
- ClassName: '蘒' WindowName: ''
- ClassName: '渀睸湤' WindowName: ''
- ClassName: '懲' WindowName: ''
- ClassName: '殺' WindowName: ''
- ClassName: '婢' WindowName: ''
- ClassName: '猪' WindowName: ''
- ClassName: '變' WindowName: ''
- ClassName: '' WindowName: 'OllyDbg - [CPU]'
- ClassName: 'ff' WindowName: ''
- ClassName: 'ﬠ' WindowName: ''
- ClassName: 'נּ' WindowName: ''
- ClassName: '眀牥慣d' WindowName: ''
- ClassName: 'ﮀ' WindowName: ''
- ClassName: '礀煸' WindowName: ''
- ClassName: 'ﮠ' WindowName: ''
- ClassName: '﯀' WindowName: ''
- ClassName: 'ࢆ㼸' WindowName: ''
- ClassName: '厁㼸' WindowName: ''
- ClassName: '眀煥x' WindowName: ''
- ClassName: '扶煲硷x' WindowName: ''
- ClassName: '汬扩' WindowName: ''
- ClassName: '攀晬汩慥' WindowName: ''
- ClassName: '焀敷穱d' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'HTTP Debugger (32bits)'
- ClassName: '' WindowName: 'MugenJinFuu-i386.exe'
- ClassName: '' WindowName: 'Mugen JinFuu.exe'
- ClassName: '' WindowName: 'MugenJinFuu-x86_64-SSE4-AVX2.exe'
- ClassName: '' WindowName: 'MugenJinFuu-x86_64.exe'
- ClassName: '' WindowName: 'Progress Telerik Fiddler Web Debugger'
- ClassName: '' WindowName: 'x64dbg'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'dnSpy'
- ClassName: '' WindowName: 'idaq64'
- ClassName: '' WindowName: 'Fiddler Everywhere'
- ClassName: '' WindowName: 'Wireshark'
- ClassName: '' WindowName: 'Dumpcap'
- ClassName: '' WindowName: 'Fiddler.WebUi'
- ClassName: '' WindowName: 'HTTP Debugger'
- ClassName: '睶牥慣d' WindowName: ''
- ClassName: '' WindowName: 'ida64'
- ClassName: '' WindowName: 'IDA v7.0.170914'
- ClassName: '捳搠汥瑥呅' WindowName: ''
- ClassName: '喠睴' WindowName: ''
- ClassName: '縨｜߾' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '斀睰' WindowName: ''
- ClassName: '灶潲硥' WindowName: ''
- ClassName: '䅃坔剁⁅低䅖簠栠瑴獰⼺搯獩潣摲朮⽧慣睴牡e' WindowName: ''
- ClassName: '짠4' WindowName: ''
- ClassName: 'ﴠ' WindowName: ''
- ClassName: '獹' WindowName: ''
- ClassName: '湦睸湤' WindowName: ''
- ClassName: '睱煥x' WindowName: ''
- ClassName: '' WindowName: 'Immunity Debugger - [CPU]'
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C sc create ET binPath=<DRIVERS>\ee.sys type= kernel' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc start ET' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc delete ET' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C sc create ET binPath=<DRIVERS>\ee.sys type= kernel
- '<SYSTEM32>\cmd.exe' /c sc stop EasyAntiCheatSys >nul 2>&1
- '<SYSTEM32>\sc.exe' stop EasyAntiCheat
- '<SYSTEM32>\cmd.exe' /c sc stop EasyAntiCheat >nul 2>&1
- '<SYSTEM32>\sc.exe' stop BEDaisy
- '<SYSTEM32>\cmd.exe' /c sc stop BEDaisy >nul 2>&1
- '<SYSTEM32>\sc.exe' stop BEService
- '<SYSTEM32>\cmd.exe' /c sc stop BEService >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteLauncher.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteClient-Win64-Shipping_BE.exe >nul 2>&1
- '<SYSTEM32>\sc.exe' delete ET
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /C sc delete ET
- '<SYSTEM32>\sc.exe' start ET
- '<SYSTEM32>\sc.exe' create ET binPath=<DRIVERS>\ee.sys type= kernel
- '<SYSTEM32>\cmd.exe' /C sc start ET
- '<SYSTEM32>\sc.exe' stop EasyAntiCheatSys
- '<SYSTEM32>\cmd.exe' /c cls
