Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM "EpicGamesLauncher.exe" /T /F
- '<SYSTEM32>\taskkill.exe' /IM "FortniteClient-Win64-Shipping.exe" /T /F
- '<SYSTEM32>\taskkill.exe' /IM "FortniteClient-Win64-Shipping_EAC.exe" /T /F
- '<SYSTEM32>\taskkill.exe' /IM "FortniteLauncher.exe" /T /F
Modifies file system
Creates the following files
- %ProgramFiles%\ghostbanfn\temp_cleaner.exe
Network activity
TCP
HTTP GET requests
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt
UDP
- DNS ASK cd#.##scordapp.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\ghostbanfn\temp_cleaner.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH INT IP RESET"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH WINSOCK RESET"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "WMIC LOGICALDISK GET NAME"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCU\SOFTWARE\Epic Games" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\EpicGames" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\EpicGames" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\Epic Games" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\Classes\com.epicgames.launcher" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCR\com.epicgames.launcher" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV4 RESET"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1001\Software\Epic Games" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-501\Software\Epic Games" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1004\Software\Epic Games" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-500\Software\Epic Games" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "WMIC USERACCOUNT GET SID"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteLauncher.exe" /T /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping_EAC.exe" /T /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping.exe" /T /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "EpicGamesLauncher.exe" /T /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /s /c "fsutil dirty query %systemdrive%"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1002\Software\Epic Games" /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV6 RESET"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /s /c "fsutil dirty query %systemdrive%"
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\WOW6432Node\Epic Games" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\EpicGames" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\WOW6432Node\EpicGames" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\EpicGames" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\EpicGames" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCU\SOFTWARE\Epic Games" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\Classes\com.epicgames.launcher" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\Epic Games" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKCU\SOFTWARE\Epic Games" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH WINSOCK RESET"
- '<SYSTEM32>\netsh.exe' WINSOCK RESET
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH INT IP RESET"
- '<SYSTEM32>\netsh.exe' INT IP RESET
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV4 RESET"
- '<SYSTEM32>\netsh.exe' INTERFACE IPV4 RESET
- '<SYSTEM32>\cmd.exe' /d /s /c "WMIC LOGICALDISK GET NAME"
- '<SYSTEM32>\wbem\wmic.exe' LOGICALDISK GET NAME
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\Classes\com.epicgames.launcher" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKCR\com.epicgames.launcher" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCR\com.epicgames.launcher" /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "EpicGamesLauncher.exe" /T /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping.exe" /T /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping_EAC.exe" /T /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteLauncher.exe" /T /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "WMIC USERACCOUNT GET SID"
- '<SYSTEM32>\wbem\wmic.exe' USERACCOUNT GET SID
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-500\Software\Epic Games" /F"
- '<SYSTEM32>\fsutil.exe' dirty query C
- '<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-500\Software\Epic Games" /F
- '<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1004\Software\Epic Games" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-501\Software\Epic Games" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-501\Software\Epic Games" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1002\Software\Epic Games" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1002\Software\Epic Games" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1001\Software\Epic Games" /F"
- '<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1001\Software\Epic Games" /F
- '<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1004\Software\Epic Games" /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV6 RESET"
- '<SYSTEM32>\netsh.exe' INTERFACE IPV6 RESET
