Overview

overview

6

Static

static

1

RobloxPlay...er.exe

windows11-21h2-x64

6

RobloxPlay...er.exe

ubuntu-22.04-amd64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    5.4MB

  • Sample

    240523-g6eyzagc8v

  • MD5

    1f1ae0eb12231c472e7ab91a6df69b75

  • SHA1

    3c0b44b3b18df2b9be602b551828b27604ef51fe

  • SHA256

    4f62cee70845d868afed5b5ad66d7fdc582e6f9b6b69e6d5e9c52a1e24105b60

  • SHA512

    470162197814bcefa52a24e1e88264827e4a6aaa0a110a41f35cd9c392bdcf6bd7deb25bf5c9ccbb994ba01b8a7851d7f5025ed5b9ad9f4ba94eabcf7f103abd

  • SSDEEP

    98304:r3vj6u39OyzUjFE6g7U8CBtg/gRLhiKLCAemBG4UuldUa:Tl3pcJbg/aCABnU+

Score
6/10
adwarediscoveryevasionlinuxpersistencestealertrojan

Malware Config

Targets

    • Target

      RobloxPlayerInstaller.exe

    • Size

      5.4MB

    • MD5

      1f1ae0eb12231c472e7ab91a6df69b75

    • SHA1

      3c0b44b3b18df2b9be602b551828b27604ef51fe

    • SHA256

      4f62cee70845d868afed5b5ad66d7fdc582e6f9b6b69e6d5e9c52a1e24105b60

    • SHA512

      470162197814bcefa52a24e1e88264827e4a6aaa0a110a41f35cd9c392bdcf6bd7deb25bf5c9ccbb994ba01b8a7851d7f5025ed5b9ad9f4ba94eabcf7f103abd

    • SSDEEP

      98304:r3vj6u39OyzUjFE6g7U8CBtg/gRLhiKLCAemBG4UuldUa:Tl3pcJbg/aCABnU+

    Score
    6/10
    adwarediscoveryevasionpersistencestealertrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

4
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks