General
-
Target
Nexus-Roblox.zip
-
Size
6.7MB
-
Sample
250104-1empaaykfy
-
MD5
3379d69cc0f4f659e9ddbe7489c340af
-
SHA1
1c5a761a156422fd2b54bc047a794f1cd9ed4995
-
SHA256
ac574eaf659c27c5b06ebe1cc4c125665c7219e1255f8e0ba7bbc61d5046b25c
-
SHA512
f11069f55ce297f25a19e3a18051b0f1788f8730dbc748ca2e1a545e75c61b8548f2fa41923ac41d51a3ea7e4d66beab222f37e7c670c610ca07a9cc43368c83
-
SSDEEP
196608:I3bPWRIsMj+csK9gh6BkfMTMV6dNC2v+sgSaD7zp3D3XIr:y5mcrClUMgd0WZ4Ir
Static task
static1
Behavioral task
behavioral1
Sample
Nexus-Roblox/DLLs/Packaged/Resource.dll
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Nexus-Roblox/Nexus-Roblox.exe
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Nexus-Roblox/Serilog.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Nexus-Roblox/iconengines/qsvgicon.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Nexus-Roblox/printsupport/windowsprintersupport.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Nexus-Roblox/zlib1.dll
Resource
win11-20241007-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Targets
-
-
Target
Nexus-Roblox/DLLs/Packaged/Resource.dll
-
Size
189B
-
MD5
4427aeee68321d0f4d7befa74e669f83
-
SHA1
4670003762a1c217c9e8ea48fcc53f2871a7c341
-
SHA256
a9661f89b8d957f4e71cbe1ba0342a39e5b50a1d80d974e2e1b349a273967f1b
-
SHA512
9d9156aa8fdebf19363fed2edb82235642c8c20549369470e44fdc0db41324e2160968fd7dd43eecce1ce3da9c03dd05cdefc8d903a9d0394f5ca9a73f5c5fa3
Score1/10 -
-
-
Target
Nexus-Roblox/Nexus-Roblox.exe
-
Size
801KB
-
MD5
217c1089e6eb10d17ce3e2fc3b099a86
-
SHA1
2bd83604d67c3f4d66d4f3e6804b25a62df97da5
-
SHA256
45b6bcdbd8d962b221579ba1a17bb7239646c6a753c3d69ce6efa160dd60a824
-
SHA512
92f836dfd7b8962632da108d76a04aa4596eaa64ffb3ff8a12da42b018cf3319fc47e5244152356a0106bde1284484cf4cc3cbc20714f71728100dc1b15ffcca
-
SSDEEP
12288:93K1Pp+lMeB8zFsgMH+GsGde1vy0xt4K7waB7DFsgMH+GsGde1vy0xt4K7waB7N:pK1PSMZ3MH4KoqqV7nMH4KoqqV7N
-
Lumma family
-
Suspicious use of SetThreadContext
-
-
-
Target
Nexus-Roblox/Serilog.dll
-
Size
125KB
-
MD5
181f3e3d0c509566283156816eb317ca
-
SHA1
400debdd4fb9ae24719157132a87c4bfeff7fa6c
-
SHA256
db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
-
SHA512
039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
-
SSDEEP
3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
Score1/10 -
-
-
Target
Nexus-Roblox/iconengines/qsvgicon.dll
-
Size
34KB
-
MD5
a85ea17fb2ca9258e71d0a60667eae6a
-
SHA1
9bc4333321611769a51bcb5292c0517c227614c6
-
SHA256
5456152400a84c153728007bd1c7d549788d2300441addd40c18d7e17f757856
-
SHA512
ead8a715f75c82fe85a2d475010d8c880b13700c847840810bd6f75f6a4a418ded406133404a1c3d196461d676f8819a7bff25e556d25250d031e513303f81eb
-
SSDEEP
768:crdZm5mjw1lQR8Z3Zf3V+hFem0wKk84XmydDGFUf2hE:6u1lQQ3Zf3V+Lem0wKk849kUfP
Score3/10 -
-
-
Target
Nexus-Roblox/printsupport/windowsprintersupport.dll
-
Size
43KB
-
MD5
33861624e98d79ef87e1f936785e6f55
-
SHA1
774ab45bf39289f9723363ae8819a771c67b69df
-
SHA256
dc4f1c80081059aa1ec426a2d66afd5163b04f7a3ac0ae275bf650d66894b492
-
SHA512
9c56ae87d2702804f4dcc8c5cac83860f8a2f5e8c59059ab29d176e08d56b801c7e9775fc02a7c27ee14ccfc31ff64f3f50e8d2b74823ec7b48077274e56bc87
-
SSDEEP
768:xXhkTJrc5LMOqZidKxpsi5IW3y7GRepuACpdDGpzUf2hmAj:xXhkTecOKxpn5B3y7GRepuACpUzUf2j
Score3/10 -
-
-
Target
Nexus-Roblox/zlib1.dll
-
Size
117KB
-
MD5
66a3477a51e8b7d4586edf4659cde8d5
-
SHA1
3306c6aca3937d8bca11dd076effb03746367b9f
-
SHA256
cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443
-
SHA512
948ba42499bba17b552723c3189289e9f07879c9303ec6f27b4d631b7d701c16fe66fc8c6a681236cef778b0cb0a14420493e048aa90bba682606ce2990c64ab
-
SSDEEP
3072:djf8ECbYiB317HVhVpaKdAAcsrK2M2nuh2UI6vTH2F3I:xLCbYiBp1LghAxG9BI6LH2F3I
Score1/10 -