General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    2.0MB

  • Sample

    230131-vk7nrahb83

  • MD5

    c9c37cc5d113277b3851bda9945361f3

  • SHA1

    90ecb64b54b1df08cd75fd10669397c5dd790947

  • SHA256

    219b13ec029b6da2847b67f049c3939136fc7154bc0255356d9aa2c4751393c0

  • SHA512

    71a4a8d35f4a7ba0f815eb86fed61c0a8d5bd258fea3a4dc6de486e0646e4b2f8fda1366ef6b884f2c116f183e6b29acdc2598ff3f9d51897bfd93d9e8448d12

  • SSDEEP

    49152:jBzJhqgJrpi9ZE7K2/Twzakz1p9TnVMfPMQ3d2XLTDb6ga3:HhqAMrE7K1Hbi3

Malware Config

Targets

    • Target

      RobloxPlayerLauncher.exe

    • Size

      2.0MB

    • MD5

      c9c37cc5d113277b3851bda9945361f3

    • SHA1

      90ecb64b54b1df08cd75fd10669397c5dd790947

    • SHA256

      219b13ec029b6da2847b67f049c3939136fc7154bc0255356d9aa2c4751393c0

    • SHA512

      71a4a8d35f4a7ba0f815eb86fed61c0a8d5bd258fea3a4dc6de486e0646e4b2f8fda1366ef6b884f2c116f183e6b29acdc2598ff3f9d51897bfd93d9e8448d12

    • SSDEEP

      49152:jBzJhqgJrpi9ZE7K2/Twzakz1p9TnVMfPMQ3d2XLTDb6ga3:HhqAMrE7K1Hbi3

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks