Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im python.exe
- '<SYSTEM32>\taskkill.exe' /f /im FortniteConsole.exe
- '<SYSTEM32>\taskkill.exe' /f /im RaidFNLauncher.exe
- '<SYSTEM32>\taskkill.exe' /im EpicGamesLauncher.exe
Modifies file system
Creates the following files
- %TEMP%\b47f.tmp\b480.tmp\b481.bat
- nul
Deletes the following files
- %TEMP%\b47f.tmp\b480.tmp\b481.bat
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B47F.tmp\B480.tmp\B481.bat <Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 60 /nobreak
- '<SYSTEM32>\tasklist.exe' /fi "IMAGENAME eq FortniteLauncher.exe"
- '<SYSTEM32>\find.exe' /i "FortniteLauncher.exe"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B47F.tmp\B480.tmp\B481.bat <Full path to file>"' (with hidden window)
