General

  • Target

    RobuxMethod.exe

  • Size

    902KB

  • Sample

    230513-2xcsgacb5x

  • MD5

    0ccae06c602cb87fc6a8e5b78d4b377e

  • SHA1

    1f6607d2f20a617a7b6aeb34d9acf43246d4195f

  • SHA256

    9e50714e07170ecf3ea21369f84f9abd6db060fbc1e5d6dfdf4923f874a70b6f

  • SHA512

    a072579827c4f45e8746d2a8999456d0dd728c07260cd38ddf3c6581163449cc8b912fb8d55449af1ee832f2b87e9010ffdb874e784a9b76c23aa9e59a00b7dc

  • SSDEEP

    24576:hwT7rC6qSL3ym95YE0bykWe0S8BY4RfkWrG:QrC6qS77KbLWeRwzrG

Malware Config

Targets

    • Target

      RobuxMethod.exe

    • Size

      902KB

    • MD5

      0ccae06c602cb87fc6a8e5b78d4b377e

    • SHA1

      1f6607d2f20a617a7b6aeb34d9acf43246d4195f

    • SHA256

      9e50714e07170ecf3ea21369f84f9abd6db060fbc1e5d6dfdf4923f874a70b6f

    • SHA512

      a072579827c4f45e8746d2a8999456d0dd728c07260cd38ddf3c6581163449cc8b912fb8d55449af1ee832f2b87e9010ffdb874e784a9b76c23aa9e59a00b7dc

    • SSDEEP

      24576:hwT7rC6qSL3ym95YE0bykWe0S8BY4RfkWrG:QrC6qS77KbLWeRwzrG

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detects Eternity stealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Modifies Windows Defender Real-time Protection settings

    • Disables Task Manager via registry modification

    • Drops startup file

    • Executes dropped EXE

    • Windows security modification

MITRE ATT&CK Enterprise v6

Tasks