49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac

General

Target
Roblox.Account.Manager.3.7.2.zip
Size 4.2MB
Sample260416-tcb2faev5n
SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
MD5 d58b79cb3d3635ba963427362f75d075
SHA1 0e33eeff9b625fceb2d2d0195e6f32523d57db79
SHA512 176de76618d0dc43f17e2971787666b737d7308a67f40bd2bb82ab4f0d3276f877fbeb7cc987f797e6572ec736c29d8568f441194a45cb5ba8d751bf139ab79a
SSDEEP 98304:gYRAasq6wh5OiduKi0yAlWNYrsmekq13pgOtleGlci1D7VaMV:7y5haDbyAMNY4mekmCOtQi1laa
TLSH
T199163355FFF3828EC2A1A1755041ED3AFB994ACABB30DDED4A60E7E29C08D511C0679C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Roblox.Account.Manager.3.7.2.zip
- Size 4.2MB
- SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
- MD5 d58b79cb3d3635ba963427362f75d075
- SHA1 0e33eeff9b625fceb2d2d0195e6f32523d57db79
- SHA512 176de76618d0dc43f17e2971787666b737d7308a67f40bd2bb82ab4f0d3276f877fbeb7cc987f797e6572ec736c29d8568f441194a45cb5ba8d751bf139ab79a
- SSDEEP 98304:gYRAasq6wh5OiduKi0yAlWNYrsmekq13pgOtleGlci1D7VaMV:7y5haDbyAMNY4mekmCOtQi1laa
- TLSH
  T199163355FFF3828EC2A1A1755041ED3AFB994ACABB30DDED4A60E7E29C08D511C0679C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Roblox Account Manager.exe
- Size 5.4MB
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
- MD5 334728f32a1144c893fdffc579a7709b
- SHA1 97d2eb634d45841c1453749acb911ce1303196c0
- SHA512 5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f
- SSDEEP 98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE
- TLSH
  T12246E02A72A04335E5AB45344468C1B496FE7E3A6A68E29EE7C0BD5F3DF5BD09430313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware credential_access discovery execution persistence ransomware spyware stealer
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral2