General
-
Target
Roblox Exploits & Hacks & Cheats - WeAreDevs.html
-
Size
44KB
-
Sample
241120-npx7jswmgs
-
MD5
cad3e9b4722a16f18422ec673d13d05b
-
SHA1
efd4f5fff4b3c5d2afd1187b0dc2e681870c8c78
-
SHA256
87c04dddca46b42e8221c9c002ff39beec48ba8bf9577002df307cca6942b7f4
-
SHA512
e78dd24ae9c379986db4c780be5d6dedfc470cce8fa5bb4bc8e75a4b21362a001f144c30e0bd75f76dad0e6b106bcc2ab505195319b92de3f83eb1729545f040
-
SSDEEP
768:lEk5ilUlLqIiVfvOflS5/u01/8xWApJingqna03O7m7Y7r2GublSNFSrZ/:ll5ilUlLqIiVfWflS5/u0/8xWAringqJ
Static task
static1
Malware Config
Targets
-
-
Target
Roblox Exploits & Hacks & Cheats - WeAreDevs.html
-
Size
44KB
-
MD5
cad3e9b4722a16f18422ec673d13d05b
-
SHA1
efd4f5fff4b3c5d2afd1187b0dc2e681870c8c78
-
SHA256
87c04dddca46b42e8221c9c002ff39beec48ba8bf9577002df307cca6942b7f4
-
SHA512
e78dd24ae9c379986db4c780be5d6dedfc470cce8fa5bb4bc8e75a4b21362a001f144c30e0bd75f76dad0e6b106bcc2ab505195319b92de3f83eb1729545f040
-
SSDEEP
768:lEk5ilUlLqIiVfvOflS5/u01/8xWApJingqna03O7m7Y7r2GublSNFSrZ/:ll5ilUlLqIiVfWflS5/u0/8xWAringqJ
-
Quasar family
-
Quasar payload
-
A potential corporate email address has been identified in the URL: %./2678@CDFRabcdefghilmnoprstuvwy
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-