General

  • Target

    Roblox Exploits & Hacks & Cheats - WeAreDevs.html

  • Size

    44KB

  • Sample

    241120-npx7jswmgs

  • MD5

    cad3e9b4722a16f18422ec673d13d05b

  • SHA1

    efd4f5fff4b3c5d2afd1187b0dc2e681870c8c78

  • SHA256

    87c04dddca46b42e8221c9c002ff39beec48ba8bf9577002df307cca6942b7f4

  • SHA512

    e78dd24ae9c379986db4c780be5d6dedfc470cce8fa5bb4bc8e75a4b21362a001f144c30e0bd75f76dad0e6b106bcc2ab505195319b92de3f83eb1729545f040

  • SSDEEP

    768:lEk5ilUlLqIiVfvOflS5/u01/8xWApJingqna03O7m7Y7r2GublSNFSrZ/:ll5ilUlLqIiVfWflS5/u0/8xWAringqJ

Malware Config

Targets

    • Target

      Roblox Exploits & Hacks & Cheats - WeAreDevs.html

    • Size

      44KB

    • MD5

      cad3e9b4722a16f18422ec673d13d05b

    • SHA1

      efd4f5fff4b3c5d2afd1187b0dc2e681870c8c78

    • SHA256

      87c04dddca46b42e8221c9c002ff39beec48ba8bf9577002df307cca6942b7f4

    • SHA512

      e78dd24ae9c379986db4c780be5d6dedfc470cce8fa5bb4bc8e75a4b21362a001f144c30e0bd75f76dad0e6b106bcc2ab505195319b92de3f83eb1729545f040

    • SSDEEP

      768:lEk5ilUlLqIiVfvOflS5/u01/8xWApJingqna03O7m7Y7r2GublSNFSrZ/:ll5ilUlLqIiVfWflS5/u0/8xWAringqJ

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • A potential corporate email address has been identified in the URL: %./2678@CDFRabcdefghilmnoprstuvwy

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Network Share Discovery

      Attempt to gather information on host network.

MITRE ATT&CK Enterprise v15

Tasks