General

  • Target

    RobloxPlayerLauncher(3).exe.bin

  • Size

    802KB

  • Sample

    230501-yxcwpagd73

  • MD5

    9812038a6c7486d0dc1f8e969a6d7cd4

  • SHA1

    fa52199ba58801e2f30b87a3cc65b7fbc6bacb46

  • SHA256

    3aee6b38574e99cb92469161cf3319223e786a265b83be6aff25e15a9cf10ca6

  • SHA512

    1f01100c892a8c700640e263b76692186fcb073df32a8e8443fdbbfed9b0b499bbcb05b6ffaee53f4cc987ee87c98cbab58bd69672aa46bd9be488ad0a50e599

  • SSDEEP

    24576:v/dWIGPuNImcNai7Ntmkny1+TC3VjT7Hg:v/dUuNI7NaoTm5gT+XHg

Malware Config

Targets

    • Target

      RobloxPlayerLauncher(3).exe.bin

    • Size

      802KB

    • MD5

      9812038a6c7486d0dc1f8e969a6d7cd4

    • SHA1

      fa52199ba58801e2f30b87a3cc65b7fbc6bacb46

    • SHA256

      3aee6b38574e99cb92469161cf3319223e786a265b83be6aff25e15a9cf10ca6

    • SHA512

      1f01100c892a8c700640e263b76692186fcb073df32a8e8443fdbbfed9b0b499bbcb05b6ffaee53f4cc987ee87c98cbab58bd69672aa46bd9be488ad0a50e599

    • SSDEEP

      24576:v/dWIGPuNImcNai7Ntmkny1+TC3VjT7Hg:v/dUuNI7NaoTm5gT+XHg

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks