Overview

overview

6

Static

static

1

RobloxPlay...3).exe

windows7-x64

6

RobloxPlay...3).exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    RobloxPlayerInstaller (3).exe

  • Size

    4.6MB

  • Sample

    240315-x39xyaah78

  • MD5

    f2ab971188e38589e09627a28c6a4166

  • SHA1

    c06b344bb4549cc3c544bc4e806765e732c295fb

  • SHA256

    4e51c3c2d137c03478fb5baccd01fea368c9af1d6140947be5c959f2b7ff132e

  • SHA512

    031c8c895a690ae422b4fed61d5596044a4314a6365386ee7baaf246987cb998bb071f7f55f3a22cbdea0a2bc0d7e6fefe345046feaa6d4f5efff39bcf6803c7

  • SSDEEP

    98304:Snv+fpQMp+3DTM7iK4lH0Fg33rlZqSkwaSfSyq7Gba:KIQpDOiK4Kgnz1ftvu

Score
6/10
discoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      RobloxPlayerInstaller (3).exe

    • Size

      4.6MB

    • MD5

      f2ab971188e38589e09627a28c6a4166

    • SHA1

      c06b344bb4549cc3c544bc4e806765e732c295fb

    • SHA256

      4e51c3c2d137c03478fb5baccd01fea368c9af1d6140947be5c959f2b7ff132e

    • SHA512

      031c8c895a690ae422b4fed61d5596044a4314a6365386ee7baaf246987cb998bb071f7f55f3a22cbdea0a2bc0d7e6fefe345046feaa6d4f5efff39bcf6803c7

    • SSDEEP

      98304:Snv+fpQMp+3DTM7iK4lH0Fg33rlZqSkwaSfSyq7Gba:KIQpDOiK4Kgnz1ftvu

    Score
    6/10
    evasiontrojandiscoverypersistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks