Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RobloxBetaPlayer2.0.exe
-
Size
117KB
-
Sample
240722-skrw7aterd
-
MD5
b8eaccd62fe739703659570be7a1f8c5
-
SHA1
82ef334ea8b4ee9948f3c77894f721cadf823fd4
-
SHA256
e7beaecc76632a2ce20f416959ea63e2d8b7b5f718cffeb17958978026d9b32f
-
SHA512
3438051927b381e28b13271d256742187cab5a156268edbb7ebe8ede491cffa5bcc7cc1ec1e8c1fade791b34711db8ac5db7a65ef79b5fe8a4ca46ca481201b1
-
SSDEEP
3072:0BaB5gDK8LubqytBZC4OaRq1HI+uM8eoWJd:0i+ibqyFCVF2
Behavioral task
behavioral1
Sample
RobloxBetaPlayer2.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
RobloxBetaPlayer2.0.exe
Resource
win11-20240709-en
Malware Config
Extracted
xworm
127.0.0.1:12550
2.tcp.eu.ngrok.io:12550
localhost:12550
-
Install_directory
%AppData%
-
install_file
Roblox2.0_Service.exe
Targets
-
-
Target
RobloxBetaPlayer2.0.exe
-
Size
117KB
-
MD5
b8eaccd62fe739703659570be7a1f8c5
-
SHA1
82ef334ea8b4ee9948f3c77894f721cadf823fd4
-
SHA256
e7beaecc76632a2ce20f416959ea63e2d8b7b5f718cffeb17958978026d9b32f
-
SHA512
3438051927b381e28b13271d256742187cab5a156268edbb7ebe8ede491cffa5bcc7cc1ec1e8c1fade791b34711db8ac5db7a65ef79b5fe8a4ca46ca481201b1
-
SSDEEP
3072:0BaB5gDK8LubqytBZC4OaRq1HI+uM8eoWJd:0i+ibqyFCVF2
Score10/10-
Detect Xworm Payload
-
Drops startup file
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-