Behavioral task
behavioral1
Sample
RobloxPlayer.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
RobloxPlayer.exe
Resource
win10v2004-20240226-en
General
-
Target
Roblox_Player.exe
-
Size
26KB
-
MD5
c38ca70397b21fb3958b573f0c646e6e
-
SHA1
908a9a1b75874e84b5bac5db93d3a3e9dc82bd5f
-
SHA256
d0edb846b44e046fee8fea55dba1160e988ccfc947cf51fbb2803ded90268d19
-
SHA512
b47c41315f4195c500aa8080b7587696d9d8608a6197d4cdfd9a478519f5884320379f87f9811e4c7c019f4b83de710610c023893b09455cf436618fdabe5b71
-
SSDEEP
384:v9YI3WhDBAdQ48ydlErkKxJl3PL5NJqdTP/CytG0xe9O8vSYohyCTh0NU8MVn:vq9BA10P9rJqdT/Cyw0xyO8vSXInNNMV
Malware Config
Extracted
discordrat
-
discord_token
MTIxNTQyMjc0OTk4ODg4NDU3Mg.G8QiY3.e2k047pCmhPxBH-tdaOfxVTB1BY3dSfZIT_sXY
-
server_id
1201970766531530822
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/RobloxPlayer.exe.exe
Files
-
Roblox_Player.exe.rar
-
RobloxPlayer.exe.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ