Overview

overview

10

Static

static

10

Roblox(unclose).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Roblox(unclose).exe

  • Size

    45KB

  • MD5

    11544ff4745a17016a9086bac7c0c83c

  • SHA1

    91440ea21b73beba389c29784be98b8b83c5ee77

  • SHA256

    ec8c79d2dead186bfc98d16e10dea1f01acd654815c1b6a468a427419624d227

  • SHA512

    b357274d5d17b05e580b9785ff8aad57ea87dcb721d46cbe8410e87e651bea2fccfd5f93796fd775947c6d0b134a2bbe138857f13c40fda8c634e02bd5e18b48

  • SSDEEP

    768:ru1a21T3EiJfWUzDydmo2qzConp/JtByBlPI1zjbKgX3i4G03gSjt7Of78BDZ5A:ru1a21T3xq2Rop/J113bdXS7zSJ7/d5

Score
10/10
ratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

https://d43b-88-230-120-156.ngrok-free.app:80

Mutex

NU2iszyvlx0s

Attributes
  • delay

    3

  • install

    true

  • install_file

    Datamc.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Roblox(unclose).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections