General
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
Sample
230402-etg7fsef39
-
MD5
049a90f23e906d12e2100fc314826152
-
SHA1
4b92f2e4e367c0e66ee2062e353eafeec10027ae
-
SHA256
8a1c0944292a12ebe6d71b7ed68f3b2f878a457f1da813545e145a5e55b15e28
-
SHA512
9008a4681bd2f7946839373a816062515a264b57de780ee766e3d7f920cea07e3364da5a77beb3e453d41499812cc912902543e5366c88e7ff42b669b8b63ffd
-
SSDEEP
49152:m6d/Cr0NWwE4WUXgbS/1kb5TY5aWaBCb/TBbMhPMQ3dAonTXUm/sT1:bw0VEagbEOCuUm/+
Static task
static1
Malware Config
Targets
-
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
MD5
049a90f23e906d12e2100fc314826152
-
SHA1
4b92f2e4e367c0e66ee2062e353eafeec10027ae
-
SHA256
8a1c0944292a12ebe6d71b7ed68f3b2f878a457f1da813545e145a5e55b15e28
-
SHA512
9008a4681bd2f7946839373a816062515a264b57de780ee766e3d7f920cea07e3364da5a77beb3e453d41499812cc912902543e5366c88e7ff42b669b8b63ffd
-
SSDEEP
49152:m6d/Cr0NWwE4WUXgbS/1kb5TY5aWaBCb/TBbMhPMQ3dAonTXUm/sT1:bw0VEagbEOCuUm/+
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-