Extracted

• • Target

    robloxedo.exe

  • Size

    11.1MB

  • MD5

    d3611d0ab0b97b6d07c7af9a5adb2a1d

  • SHA1

    a5da8163036698bf4d2b8d3508861bd5d2219014

  • SHA256

    4f206fa1d3a1ea145ad327bf8530243d0a58b2f313d80b5c74c11c8cc3f7809e

  • SHA512

    834a7bb8c2133c6e71712963aaccbd70cbdbb7460a96d9347ec8c8e66c9c9e7ad755da60931d3bcef87f45755eb23189306570ecaaa5da237eec898dd4532067

  • SSDEEP

    196608:Xrk0YXXOshoKMuIkhVastRL5Di3unSE3OQMAgV0nEX32zwVv+RQ6Qhm6Ytn:JYnOshouIkPftRL54XnwgVZ3giGKc6Yt

  Score

  10^/10

  asyncratzgrat1877evasionexecutionratspywarestealerupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1