3e091df4051e6b0859c2142a0869a415e5968c20edb5e9a60fcd077f7b61be19 | Triage

Submit
Reports

Overview

overview

Static

static

3

Roblox Evo...57.exe

windows7-x64

7

Roblox Evo...57.exe

windows10-2004-x64

Resubmissions

26/03/2025, 14:51 UTC

250326-r8fcmaypv6 7

06/02/2025, 18:35 UTC

250206-w8pcrasqgx 7

16/01/2025, 14:09 UTC

250116-rf53ksvldl 10

08/01/2025, 00:01 UTC

250108-abax7svle1 7

06/01/2025, 13:40 UTC

250106-qykc6axqav 10

18/12/2024, 13:25 UTC

241218-qn96tszrbs 7

12/12/2024, 19:51 UTC

241212-yk9d5avrew 10

28/03/2024, 18:16 UTC

240328-wwlfbsdf99 7

Sharing

General

Target

Roblox Evon Exploit V4_41257.exe
Size

8.7MB
Sample

241212-yk9d5avrew
MD5

98194b1fd3ceea50438976b40ea59d05
SHA1

ed918fbb5765aa91e5c9d2c492ec00667478ac35
SHA256

3e091df4051e6b0859c2142a0869a415e5968c20edb5e9a60fcd077f7b61be19
SHA512

9587acb23ee51e4743c5399b78b64f2a0e87e2413cd56e220df8c08ebe0f352ac0ca83c1826f09718876a6248057e9cbac0f38ee725de83b4ca7de4f805f30bf
SSDEEP

196608:wu6nOE62LOa8ewFCrqNeuUG59Fa9FVDNWXVkHo/ly:MOb2C6wFCrqNZ529PDNs2Ho/k

Score

10^/10

google discovery phishing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Roblox Evon Exploit V4_41257.exe

Resource

win7-20240903-en

windows7-x64

13 signatures

1800 seconds

Behavioral task

behavioral2

Sample

Roblox Evon Exploit V4_41257.exe

Resource

win10v2004-20241007-en

google discovery phishing

windows10-2004-x64

20 signatures

1800 seconds

Malware Config

Targets

- Target
  
  Roblox Evon Exploit V4_41257.exe
- Size
  
  8.7MB
- MD5
  
  98194b1fd3ceea50438976b40ea59d05
- SHA1
  
  ed918fbb5765aa91e5c9d2c492ec00667478ac35
- SHA256
  
  3e091df4051e6b0859c2142a0869a415e5968c20edb5e9a60fcd077f7b61be19
- SHA512
  
  9587acb23ee51e4743c5399b78b64f2a0e87e2413cd56e220df8c08ebe0f352ac0ca83c1826f09718876a6248057e9cbac0f38ee725de83b4ca7de4f805f30bf
- SSDEEP
  
  196608:wu6nOE62LOa8ewFCrqNeuUG59Fa9FVDNWXVkHo/ly:MOb2C6wFCrqNZ529PDNs2Ho/k
Score

10^/10

discovery google phishing
- Detected google phishing page
  phishing google
- A potential corporate email address has been identified in the URL: jeffersonowen.remy@sascholar.org
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Browser Information Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

googlediscoveryphishing

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.