385435c6c03f4aeb9c3511b991b58efee624f8ecdeda789200c33e88eeed58ef | Triage

Sharing

General

Target

hacks_roblox
Size

149KB
Sample

241010-pbad1a1cln
MD5

4d4b8c6dd2e7fa800ff3cea15d42aba3
SHA1

f7e4bd4d2a409373a00fd8aacae526aca64c0912
SHA256

385435c6c03f4aeb9c3511b991b58efee624f8ecdeda789200c33e88eeed58ef
SHA512

f1d3d23c06d7e241610a717c3f955b7d961535f80d941f8a7b80a2c19d3de4bc7c650640ac233337f12ff15c7b62905671d7b37012941baf91fb5612f5dcdd74
SSDEEP

1536:IRPEVWYAc17jsAPA118IXAE1wAG12AC14ABAzAr1ZAM13D8ctWZvmWS6/:IRPEf17js1x1I1m1X131T8cgZvmWS6/

Score

8^/10

discovery evasion

Malware Config

Targets

- Target
  
  hacks_roblox
- Size
  
  149KB
- MD5
  
  4d4b8c6dd2e7fa800ff3cea15d42aba3
- SHA1
  
  f7e4bd4d2a409373a00fd8aacae526aca64c0912
- SHA256
  
  385435c6c03f4aeb9c3511b991b58efee624f8ecdeda789200c33e88eeed58ef
- SHA512
  
  f1d3d23c06d7e241610a717c3f955b7d961535f80d941f8a7b80a2c19d3de4bc7c650640ac233337f12ff15c7b62905671d7b37012941baf91fb5612f5dcdd74
- SSDEEP
  
  1536:IRPEVWYAc17jsAPA118IXAE1wAG12AC14ABAzAr1ZAM13D8ctWZvmWS6/:IRPEf17js1x1I1m1X131T8cgZvmWS6/
Score

8^/10

discovery evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2