Overview

overview

8

Static

static

1

RobloxPlay...er.exe

windows7-x64

8

RobloxPlay...er.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    4.5MB

  • Sample

    231004-y2143sgg65

  • MD5

    cda089edd734fab7391ac1a5f3f2435f

  • SHA1

    c32aa3d7a348fae7c9cc483f3bac11353844d226

  • SHA256

    5f5756ddb66734d0d7f206d95a6722d20654ed406d33c646c85bddd3cbb2e999

  • SHA512

    4f0c45a1965ccf4dfe21d1bd7d57f746a460b49b1549b788080e5cf2e3b433051cc327a1ccf9ea3ea3c821653d00dc8253435ebe3bca2ad48bf144dba1d306c6

  • SSDEEP

    98304:1kv2meX/z0dCX5RdBzsg+nngISXsMrMwejH39WUbVt:KSP/X5JYgI+183QUpt

Score
8/10
discoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      RobloxPlayerInstaller.exe

    • Size

      4.5MB

    • MD5

      cda089edd734fab7391ac1a5f3f2435f

    • SHA1

      c32aa3d7a348fae7c9cc483f3bac11353844d226

    • SHA256

      5f5756ddb66734d0d7f206d95a6722d20654ed406d33c646c85bddd3cbb2e999

    • SHA512

      4f0c45a1965ccf4dfe21d1bd7d57f746a460b49b1549b788080e5cf2e3b433051cc327a1ccf9ea3ea3c821653d00dc8253435ebe3bca2ad48bf144dba1d306c6

    • SSDEEP

      98304:1kv2meX/z0dCX5RdBzsg+nngISXsMrMwejH39WUbVt:KSP/X5JYgI+183QUpt

    Score
    8/10
    discoveryevasionpersistencetrojan

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks