Overview

overview

10

Static

static

3

Roblox Cus...ol.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Roblox Customization Tool.exe

  • Size

    9.6MB

  • Sample

    240423-z5kf6sca64

  • MD5

    cc0fa2e11db43e140151a1a4096321cf

  • SHA1

    7af736d3a8a91322edda6eb0161855f1cd7d3f46

  • SHA256

    dfdd1ca2316a5546c317115cc90fd40b0683e57959f2edccf497d935e2151b54

  • SHA512

    2b08c1eb64b0aec90cdf135997c7dbc9abc0e5199bed5fbd2cbbd4f7e27768e6a2194ba0430756499f9fcc4ea2f84262cfa01b73a61096b71af86ecfb0dc4868

  • SSDEEP

    196608:AYUyWD6GYErdzlhygoQi/ev4I9iagSO5z1QM73tfxpLN6z:ADvfLpo2iagJzR7TpLS

Score
10/10
njrati am furrydiscoveryevasionpersistencepyinstallertrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

I am Furry

C2

green-morrison.gl.at.ply.gg:17455

Mutex

e14109296e01cf24bb9b7f72f64c4cb3

Attributes
  • reg_key

    e14109296e01cf24bb9b7f72f64c4cb3

  • splitter

    |'|'|

Targets

    • Target

      Roblox Customization Tool.exe

    • Size

      9.6MB

    • MD5

      cc0fa2e11db43e140151a1a4096321cf

    • SHA1

      7af736d3a8a91322edda6eb0161855f1cd7d3f46

    • SHA256

      dfdd1ca2316a5546c317115cc90fd40b0683e57959f2edccf497d935e2151b54

    • SHA512

      2b08c1eb64b0aec90cdf135997c7dbc9abc0e5199bed5fbd2cbbd4f7e27768e6a2194ba0430756499f9fcc4ea2f84262cfa01b73a61096b71af86ecfb0dc4868

    • SSDEEP

      196608:AYUyWD6GYErdzlhygoQi/ev4I9iagSO5z1QM73tfxpLN6z:ADvfLpo2iagJzR7TpLS

    Score
    10/10
    njrati am furrydiscoveryevasionpersistencepyinstallertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Sets file execution options in registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

4
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Disable or Modify System Firewall

1
T1562.004

File and Directory Permissions Modification

1
T1222

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks