General

  • Target

    RobloxPlayerLauncher (2).exe

  • Size

    2.0MB

  • Sample

    230331-ykmv5aec6y

  • MD5

    ffe818bb675c441ae967cb0fb85b56d5

  • SHA1

    d1ca6c9bff52d2249698919bc73462f2de2bb284

  • SHA256

    b672e59bb345d12ebad37d174cfb2a581ddaa1626f1d52076696d5bdb1b3bdd6

  • SHA512

    66e5590134d575af49c810979c35d6f6254226ec712e7413525b47bc15082aba904b9b475ce270586ed1f378e5efb5af5d8924f3e86451b44c96f70a59b65963

  • SSDEEP

    49152:EZbE3RF3Qm9zVOfmTNtTMvapMagMTz+MPPMQ3dSK/T7ob60VWg:E5Ugm9YfmTw+ob5

Malware Config

Targets

    • Target

      RobloxPlayerLauncher (2).exe

    • Size

      2.0MB

    • MD5

      ffe818bb675c441ae967cb0fb85b56d5

    • SHA1

      d1ca6c9bff52d2249698919bc73462f2de2bb284

    • SHA256

      b672e59bb345d12ebad37d174cfb2a581ddaa1626f1d52076696d5bdb1b3bdd6

    • SHA512

      66e5590134d575af49c810979c35d6f6254226ec712e7413525b47bc15082aba904b9b475ce270586ed1f378e5efb5af5d8924f3e86451b44c96f70a59b65963

    • SSDEEP

      49152:EZbE3RF3Qm9zVOfmTNtTMvapMagMTz+MPPMQ3dSK/T7ob60VWg:E5Ugm9YfmTw+ob5

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Tasks