General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    2.0MB

  • Sample

    230131-1hn2hsae83

  • MD5

    34d6da080af6ae29247f06bcae9292c5

  • SHA1

    6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

  • SHA256

    ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

  • SHA512

    c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

  • SSDEEP

    49152:7EDwfYZf+r0RFD3zjTVTocahQ5MOTeZM2PMQ3d2HST6b6fz:PYZzR53zjG8bGz

Malware Config

Targets

    • Target

      RobloxPlayerLauncher.exe

    • Size

      2.0MB

    • MD5

      34d6da080af6ae29247f06bcae9292c5

    • SHA1

      6b1397afa50fd65b5dc38aac8e6c33ff11f9a1dd

    • SHA256

      ce68f81a0d40040d36a8090461455a9452d3e9d67b528caf4196fc19e159872b

    • SHA512

      c74684725064c8f9a76c727a4641df7ebeae414f292c07b84cd6266def454a69091c1e0994ca91e5c1e3fb411f790e572551edfe9d50ae307d2fe5fa9343f443

    • SSDEEP

      49152:7EDwfYZf+r0RFD3zjTVTocahQ5MOTeZM2PMQ3d2HST6b6fz:PYZzR53zjG8bGz

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks