General
-
Target
RobloxPlayerBeta.exe
-
Size
94.5MB
-
Sample
241225-yjtmaavqbl
-
MD5
d49e28811ffc4220a9d598d9cbf27623
-
SHA1
520e919ed6b472bf1ba2a2a31e58a5f5428764b7
-
SHA256
309dfe4802b630e6a8f272364889fcf1ec6a29b9cc71db496eb634396d3c69ca
-
SHA512
94bbf30a5c8c37ad54b697413f89248ddff97eb62a4719cf9dca7dfec78e11d3b5cadfd4d33864ca40051e83a9bb47dbf8087da5a22fa720e74ae26e50434e19
-
SSDEEP
1572864:0JiAuZGYFTxAEnpfkC1LoBobpAoNwdzHM7FLfpJRN2ogRUlygSBjx6UM6aZcST/:0sAUGYFtAypfDoBasQBRN2ogKFSBjxYp
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerBeta.exe
Resource
win10ltsc2021-20241211-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
192.168.40.236:6606
192.168.40.236:7707
192.168.40.236:8808
pP6mzysZgTAW
-
delay
3
-
install
true
-
install_file
xx.exe
-
install_folder
%AppData%
Targets
-
-
Target
RobloxPlayerBeta.exe
-
Size
94.5MB
-
MD5
d49e28811ffc4220a9d598d9cbf27623
-
SHA1
520e919ed6b472bf1ba2a2a31e58a5f5428764b7
-
SHA256
309dfe4802b630e6a8f272364889fcf1ec6a29b9cc71db496eb634396d3c69ca
-
SHA512
94bbf30a5c8c37ad54b697413f89248ddff97eb62a4719cf9dca7dfec78e11d3b5cadfd4d33864ca40051e83a9bb47dbf8087da5a22fa720e74ae26e50434e19
-
SSDEEP
1572864:0JiAuZGYFTxAEnpfkC1LoBobpAoNwdzHM7FLfpJRN2ogRUlygSBjx6UM6aZcST/:0sAUGYFtAypfDoBasQBRN2ogKFSBjxYp
-
Asyncrat family
-
Async RAT payload
-
A potential corporate email address has been identified in the URL: [email protected]
-
Executes dropped EXE
-