Overview

overview

7

Static

static

1

Roblox Evo...75.exe

windows10-2004-x64

7

Resubmissions

01-04-2023 11:40

230401-nta8kshg65 10

01-04-2023 11:34

230401-npeefabb6w 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Roblox Evon Exploit V4_80175.exe

  • Size

    8.7MB

  • Sample

    230401-npeefabb6w

  • MD5

    98194b1fd3ceea50438976b40ea59d05

  • SHA1

    ed918fbb5765aa91e5c9d2c492ec00667478ac35

  • SHA256

    3e091df4051e6b0859c2142a0869a415e5968c20edb5e9a60fcd077f7b61be19

  • SHA512

    9587acb23ee51e4743c5399b78b64f2a0e87e2413cd56e220df8c08ebe0f352ac0ca83c1826f09718876a6248057e9cbac0f38ee725de83b4ca7de4f805f30bf

  • SSDEEP

    196608:wu6nOE62LOa8ewFCrqNeuUG59Fa9FVDNWXVkHo/ly:MOb2C6wFCrqNZ529PDNs2Ho/k

Score
7/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      Roblox Evon Exploit V4_80175.exe

    • Size

      8.7MB

    • MD5

      98194b1fd3ceea50438976b40ea59d05

    • SHA1

      ed918fbb5765aa91e5c9d2c492ec00667478ac35

    • SHA256

      3e091df4051e6b0859c2142a0869a415e5968c20edb5e9a60fcd077f7b61be19

    • SHA512

      9587acb23ee51e4743c5399b78b64f2a0e87e2413cd56e220df8c08ebe0f352ac0ca83c1826f09718876a6248057e9cbac0f38ee725de83b4ca7de4f805f30bf

    • SSDEEP

      196608:wu6nOE62LOa8ewFCrqNeuUG59Fa9FVDNWXVkHo/ly:MOb2C6wFCrqNZ529PDNs2Ho/k

    Score
    7/10
    bootkitdiscoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Security Software Discovery

1
T1063

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks