Overview

overview

6

Static

static

1

RobloxPlay...er.exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    4.5MB

  • Sample

    240123-v6l9yaebe9

  • MD5

    d0d664e8b9191b60ff04374aee139d4c

  • SHA1

    e048dadb0cc7332a8d3ec1193860c07b5a51edee

  • SHA256

    e1f36bb55ba21592c38ce8ed12224353541ffbf2c0cf049f688a6155f26ff5d8

  • SHA512

    5772e508981c76b7d84d0f600003bdc7b7f98f43dff45aa059ea083cc3201349bbc13836048bbe20365a801843202ed42ff85bb93739017be9cd74e792f7bc8e

  • SSDEEP

    98304:PDv3TcSU8hmQTgnqbktGg37IWuJ/7GBPRNoVFKbjV:j3TNUnQbvg37e6BZvV

Score
6/10
discoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      RobloxPlayerInstaller.exe

    • Size

      4.5MB

    • MD5

      d0d664e8b9191b60ff04374aee139d4c

    • SHA1

      e048dadb0cc7332a8d3ec1193860c07b5a51edee

    • SHA256

      e1f36bb55ba21592c38ce8ed12224353541ffbf2c0cf049f688a6155f26ff5d8

    • SHA512

      5772e508981c76b7d84d0f600003bdc7b7f98f43dff45aa059ea083cc3201349bbc13836048bbe20365a801843202ed42ff85bb93739017be9cd74e792f7bc8e

    • SSDEEP

      98304:PDv3TcSU8hmQTgnqbktGg37IWuJ/7GBPRNoVFKbjV:j3TNUnQbvg37e6BZvV

    Score
    6/10
    discoveryevasionpersistencetrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks