Overview

overview

7

Static

static

1

RobloxPlay...er.exe

windows10-1703-x64

7

RobloxPlay...er.exe

windows7-x64

7

Resubmissions

12-05-2024 14:59

240512-scw6yaee69 7

12-05-2024 13:19

240512-qkwt2abd49 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    5.0MB

  • Sample

    240512-qkwt2abd49

  • MD5

    97d5071b4251a88c685a53051e1ae986

  • SHA1

    ef277883334b865db544af96abaff6687a1e4f42

  • SHA256

    987f45a5fa22b34fe09422b4e8fb844c4dfedae522d1ff35b833fbd0ae850d80

  • SHA512

    d9777d1c766868b3bd51c6fd55ac05fe8381ae2db00ad6072a535ea04814bd2ad92957661e73a13d2feff0812e55e8ced2a1144ee2d805ec951c30faeee22558

  • SSDEEP

    98304:aXvT3ffvvYakoCm4sRE8g/pvTNJcfZdvWbdfNwjbzI+:uTnvvYFPegDLb1uY+

Score
7/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      RobloxPlayerLauncher.exe

    • Size

      5.0MB

    • MD5

      97d5071b4251a88c685a53051e1ae986

    • SHA1

      ef277883334b865db544af96abaff6687a1e4f42

    • SHA256

      987f45a5fa22b34fe09422b4e8fb844c4dfedae522d1ff35b833fbd0ae850d80

    • SHA512

      d9777d1c766868b3bd51c6fd55ac05fe8381ae2db00ad6072a535ea04814bd2ad92957661e73a13d2feff0812e55e8ced2a1144ee2d805ec951c30faeee22558

    • SSDEEP

      98304:aXvT3ffvvYakoCm4sRE8g/pvTNJcfZdvWbdfNwjbzI+:uTnvvYFPegDLb1uY+

    Score
    7/10
    discoveryevasionpersistencespywarestealertrojan

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks