General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    2.0MB

  • Sample

    230131-c31daaed46

  • MD5

    15396fe00f8ee8d7ae41bb6884f9979b

  • SHA1

    5b57ca2e66568d55eb67349f7b68b9a792299743

  • SHA256

    9dcd1c7e9bcba6dd6c49e370d0b87ee94e2d0c5d6bbce918759cd942fcd62d07

  • SHA512

    8e3a75b176f5658a2a08ea6a17cd9dfd35bb3c8f7c5bf843ac2d1eef76ebed599710c8122165d07590845db4e30e4b4fb96456521684a2b48506cdaa6674ee7a

  • SSDEEP

    49152:hSN68wfCWTVlrX/tfQgTpiaYRo2RT48MPPMQ3d2XET4b6Qs:As8wKWTVlL/tfibBs

Malware Config

Targets

    • Target

      RobloxPlayerLauncher.exe

    • Size

      2.0MB

    • MD5

      15396fe00f8ee8d7ae41bb6884f9979b

    • SHA1

      5b57ca2e66568d55eb67349f7b68b9a792299743

    • SHA256

      9dcd1c7e9bcba6dd6c49e370d0b87ee94e2d0c5d6bbce918759cd942fcd62d07

    • SHA512

      8e3a75b176f5658a2a08ea6a17cd9dfd35bb3c8f7c5bf843ac2d1eef76ebed599710c8122165d07590845db4e30e4b4fb96456521684a2b48506cdaa6674ee7a

    • SSDEEP

      49152:hSN68wfCWTVlrX/tfQgTpiaYRo2RT48MPPMQ3d2XET4b6Qs:As8wKWTVlL/tfibBs

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks