58963df25cacb5befc394a294c2c22bdd40e4c81990dece27ecf277c7e4835cb

Sharing

Copy URL Twitter E-mail

General

Target
Roblox_setup.exe
Size 13.0MB
Sample260502-pvsppafy4x
SHA256 58963df25cacb5befc394a294c2c22bdd40e4c81990dece27ecf277c7e4835cb
MD5 7df171da63e2013c9b17e1857615b192
SHA1 4ed3c36731ba8626776df5c1266898657613b394
SHA512 020f420068a2282e7c5a95c151ed95da77b1c05375f84f3fc2b65ac1ad4ad93c5588545c4eacce657e69b17374bf16c1ebcc322f696eef6357435b715d9bfd56
SSDEEP 393216:U+hqQCivNZeMiPAU5GIcesec+1IjW2wLMNADY:EQCqyAUItj6lDY
TLSH
T1CBD633A65AF474EDCDD572710DAB4420F2BAAE3C8E01159EA0613EEFFC30B996317152
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Roblox_setup.exe
- Size 13.0MB
- SHA256 58963df25cacb5befc394a294c2c22bdd40e4c81990dece27ecf277c7e4835cb
- MD5 7df171da63e2013c9b17e1857615b192
- SHA1 4ed3c36731ba8626776df5c1266898657613b394
- SHA512 020f420068a2282e7c5a95c151ed95da77b1c05375f84f3fc2b65ac1ad4ad93c5588545c4eacce657e69b17374bf16c1ebcc322f696eef6357435b715d9bfd56
- SSDEEP 393216:U+hqQCivNZeMiPAU5GIcesec+1IjW2wLMNADY:EQCqyAUItj6lDY
- TLSH
  T1CBD633A65AF474EDCDD572710DAB4420F2BAAE3C8E01159EA0613EEFFC30B996317152
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2
- Target
  Microsoft.VC90.CRT/msvcm90.dll
- Size 219KB
- SHA256 b371af3ce6cb5d0b411919a188d5274df74d5ee49f6dd7b1ccb5a31466121a18
- MD5 4a8bc195abdc93f0db5dab7f5093c52f
- SHA1 b55a206fc91ecc3adeda65d286522aa69f04ac88
- SHA512 197c12825efa2747afd10fafe3e198c1156ed20d75bad07984caa83447d0c7d498ef67cee11004232ca5d4dbbb9ae9d43bfd073002d3d0d8385476876ef48a94
- SSDEEP 6144:ge7iXDX5qmzXOZc/cU4HqsKvts6tifkglMqbO0YLJbc89XTiuq5Kz3OaOyp:ge7iXVDzXOGJb5XTiuq5Kz+
- TLSH
  T1A624288E9B128D3BD59A5373F5A3D304D277A9912BA173C38117A2641A543C0FCBBED2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Microsoft.VC90.CRT/msvcp90.dll
- Size 555KB
- SHA256 4f7ed27b532888ce72b96e52952073eab2354160d1156924489054b7fa9b0b1a
- MD5 6de5c66e434a9c1729575763d891c6c2
- SHA1 a230e64e0a5830544a25890f70ce9c9296245945
- SHA512 27ec83ee49b752a31a9469e17104ed039d74919a103b625a9250ac2d4d8b8601034d8b3e2fa87aadbafbdb89b01c1152943e8f9a470293cc7d62c2eefa389d2c
- SSDEEP 12288:iUmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eRZRzS:iUmYoO83W0y8yeO8L3Ooc8SHkC2e8
- TLSH
  T175C4B3233B474AF5E89273F022C9132297B9FC950720B3D392DBE1A55F9A3C95673990
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Microsoft.VC90.CRT/msvcr90.dll
- Size 640KB
- SHA256 ed0170d3de86da33e02bfa1605eec8ff6010583481b1c530843867c1939d2185
- MD5 e7d91d008fe76423962b91c43c88e4eb
- SHA1 29268ef0cd220ad3c5e9812befd3f5759b27a266
- SHA512 c3d5da1631860c92decf4393d57d8bff0c7a80758c9b9678d291b449be536465bda7a4c917e77b58a82d1d7bfc1f4b3bee9216d531086659c40c41febcdcae92
- SSDEEP 12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg
- TLSH
  T1F0D48D51B6E2C032C8E611B8569CEB725A7F64B0032468E3BBD50FEDC9647C0E63775A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Microsoft.VC90.MFC/mfc90.dll
- Size 1.1MB
- SHA256 287bd98054c5d2c4126298ee50a2633edc745bc76a1ce04e980f3ecc577ce943
- MD5 462ddcc5eb88f34aed991416f8e354b2
- SHA1 6f4dbb36a8e7e594e12a2a9ed4b71af0faa762c1
- SHA512 35d21e545ce6436f5e70851e0665193bb1c696f61161145c92025a090d09e08f28272cbf1e271ff62ff31862544025290e22b15a7acde1aea655560300efe1ec
- SSDEEP 24576:HMh/PZa3TrShmbjRbf/zxUK4BpifCqY5TcB2sQL+XmDOl:HMh/PZa3HTjtFUKwhqY5TcyL+XmE
- TLSH
  T1EC35393176E88A71C9E332B4061DB735A2ADE59157340AC3A2542BFEDC753D12E3868F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Microsoft.VC90.MFC/mfcm90.dll
- Size 58KB
- SHA256 c4243ba85c2d130b4dec972cd291916e973d9d60fac5ceea63a01837ecc481c2
- MD5 d4e7c1546cf3131b7d84b39f8da9e321
- SHA1 6b096858723c76848b85d63b4da334299beced5b
- SHA512 4383e2bc34b078819777da73f1bd4a88b367132e653a7226ed73f43e4387ed32e8c2bcafd8679ef5e415f0b63422db05165a9e794f055aa8024fe3e7cabc66b9
- SSDEEP 768:kXS5hxqhOz9XNpOb/AXVuips6Pm550971BVO5nkcwo5ArrwlyQ6mrCHrO1MquTSU:kC/IMZHO0lu+s60VwvrrDmrCrO1HuTR
- TLSH
  T1BA432A452B17C9BBE98D017329B7D6541532A3E3AF3183D79002BBA9AD927C0D23D7C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Microsoft.VC90.OPENMP/vcomp90.dll
- Size 53KB
- SHA256 ffc774f6f055b1a9a899ab76dac3e141f582ce19dae0b3d4dff9d93916b42d09
- MD5 f6a85f3b0e30c96c993c69da6da6079e
- SHA1 84f53ad5f1a01e1fa1c4d26b3222e10959debd25
- SHA512 b28748abbcb3c9ccc96de2dbd240448247f295a67f24e862a89c8dfe8aa4989b5e4270ff5cb4f96f0de88b2e6b8c9dd4a375baf47a8277777e83fb5249f8f2a6
- SSDEEP 768:uPSKLA354st0Ha5FvLgUz/g0f47TsvyVkpfL2jmPGjNy/TYAU8Cy/j:uqIAca5F1vO0LSZY/I8Cy/
- TLSH
  T13C335C50758A8265FCE732F186BEFCB65AFCEACD033081E7138845E98D607D2597429E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  NPRobloxProxy.dll
- Size 326KB
- SHA256 b17115a2b1618c9e6763ed2093ddba309609f48fedc2710934084da453ed0a16
- MD5 71301f0a135a4cb93be505edeabf2f50
- SHA1 91d05c4e2fed62f8a2295471452ab445df678310
- SHA512 a04f37fb92bbf9bd3c49b90e72bc57753a619adb31baa949b1d80d3b09232ca11a67321e3986f2b5946478f1f9394af41d7687976b36d09a10a05baa61c821b9
- SSDEEP 3072:sf/ddB47XoxCwgJrjZXpyTDrBScUDJi6BqikDPsDKkq1Jogk5SOY+K57SEqD:Odqh1Zy/rkcdi6UkZk5SO1uqD
- TLSH
  T1F1647D20B282C037E4DB2576857DCBBE59A97434472665CBBBDC0ABD6F142D1AB3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  OgreMain.dll
- Size 5.2MB
- SHA256 66a769393ece82e94ee64f56808f0a9c120be6512cebd25575a78699936bf069
- MD5 f576e526e0c0bac8b85e1e8d4e43a495
- SHA1 7f0b44b86f310b841526a36c52c555be1ddd0462
- SHA512 a48093aa3b61073f34b2e11e90594388c407611b5488b5e91367fdfea481f7297fbf1bdf895be8b8a061b718d959240617758c1ec23414514c9cff3cc27011b8
- SSDEEP 49152:PZlG7tlILIoUdFulFAQEtniJoxi6RYxPQwGmIBQJ0IZruFYzJ88FwglTsRvbTMzG:h6ILQdFdQEhiJoxi62xPQwqIuE8ayh
- TLSH
  T153465B03D7B3B0E1DE5922B229BA6B1B5239AD814B554BE3B2543D1BD532FC12CB72D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Plugin_CgProgramManager.dll
- Size 44KB
- SHA256 1b9e407a9004723d0f49e6662fd0922b477920b86fd5970fb86c0382ead47e5e
- MD5 787ac4b91b336ee7bd15986ab8fabfba
- SHA1 6a3f5e7451abb5bb6e34f8c4b74f58fa87e1858c
- SHA512 49b29af4a0d5116ae811b6af84bf6650f0ffa1ad3a70ec3e8bb54c5a1823a2257389998caffbf6b60cef56dd1d4235d615d917645b11f299c52265aee9b3f4d9
- SSDEEP 768:ZojcKMgDnn1t+KYdEcp28qYMSAOE7vR0/4kmnaOKZO01:Zojc6nn1tN2L28qYMSAOx0naOKZOu
- TLSH
  T12C230817D30B81F1C24E32B72582435A4234B8012BE96BD79E8791EB2E7B7EEDCB5514
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Plugin_ParticleFX.dll
- Size 100KB
- SHA256 14f7c62227c415cca17757f2e5845cae54572e8a491f42d943207d17895a87ae
- MD5 b4179f30211d7b9a53d1024dc5fc9e30
- SHA1 07ccbec5cce943d6db04fd43e174b625c048f050
- SHA512 97f0814bf6e2b2a72e3b25cd14aa215d7cf5d3f26afc0abb920443045081d50092082696a670e2ddd23e6096493f14c42e332f908be2a7a45f11f1828793ba0e
- SSDEEP 3072:nEbrbsmmqRbpE2gkyQUSx27t85CDOKoSu:nEQmmeJNIJ85QOKoS
- TLSH
  T1C8A3D813F257A6B0E18E31722E878B16B276659147D7ABE36D9713160CB32EF1EF4102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  RenderSystem_Direct3D9.dll
- Size 1.2MB
- SHA256 be43e6371e5841660b8388ba0c1cc9c3c25948964b73e7796cd64d3842f975df
- MD5 9e690044e2bcd0a9b5a1f31c621ec125
- SHA1 0d0788290de79277f5453d68d6846ebaac568d1e
- SHA512 ca426bea15dfc63b8ab18b79822fc215bb5cfd0b8573112a57e461fa3b2e4dab3b981bb8dfea7efce0869b07fd2c3e687e4515f1d20f1ac61992761f80b252aa
- SSDEEP 24576:rvbF/mUFhIcwRVwt6N07I0d8uZE5ZHyOm:bbFjHkII0d8uZE6
- TLSH
  T1D745CF01F352C232C45B33B20667637A7279AF550B7647CB16887D7A7E352E1AB3A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  RenderSystem_GL.dll
- Size 545KB
- SHA256 4c5b72bbd776deb8eda9b5f6f489fec6ce8f2d99bd7bce86b21a8704ab0103e4
- MD5 6bfc4ece5c06bd5d45d4fca0c4f88e3f
- SHA1 ba375d04ff1aec62ccfd9df7606b4a95dfec549a
- SHA512 febf47b3888b897f047a49ddf76a5cde6593f0889c5e5255582d2e143d3776b3436b273626a7398e6bebe30593556d8aa7689041a1758bd8b88bccf58007ff1f
- SSDEEP 12288:p48RhIrRetFcTFVwN1VtEyw+q7xBx9NnO7liC:qlet8VtyEBx9lORi
- TLSH
  T1BBC46B13EB1783B6CA0B237A2453AF9B52BCA9401319A7C7F3959CA50DF5BC29CB5344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Roblox.exe
- Size 415KB
- SHA256 1263451af26d78f1b568418b04f50428d48fa24213f1de3501b8f7871d82d7fb
- MD5 b28fc57f0695c61e070b55313a30c584
- SHA1 ad43103b28f9b197d54c12f37006e707e678391f
- SHA512 5d441a21a41c67d979fce279689d56089e1e03041e74e4402e26659a7646b9d9407b3637a5882a4e4202db3cf1e1857331eed5e51aaf76887d437f05b2716d4f
- SSDEEP 6144:f/uFfA6KoV3F8k/PfFKJWuy1fUwWTBjAFrZTAHE1dw:fmFY6KoV3F8knfFHuwMwWTZJETw
- TLSH
  T172948D22B780E033C06301358A55C778A9B9FC7159255207B7D87F6FBF70293AA39B96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral27 behavioral28
- Target
  RobloxApp.exe
- Size 10.3MB
- SHA256 cf6647d8a1126f3add361a7e857d196353f4c13556fb35f1fec8a1260129febd
- MD5 a1dbbdc1985635caec4dc89495be2726
- SHA1 a7198d4dd9081580856267f75bfaf72a1bc1d30a
- SHA512 cac23e77089d0dded6866905920d473cbe755f8673b9768b4442b622bb6f63f8f577fcf62552f8995091e639cf6187ce5a41056efb05a3b4824d96ea7ef4301c
- SSDEEP 98304:JQ2fEUc5KIZnCQ1b6tBgjnzYHyXNv3snpohFyi2I+oTGL5dBFpr2dHRn+1eGg:JPw9nl1b66MSX2npohM1IZrOeGg
- TLSH
  T1F0B64B01F7A781F5C68621753DAE7B4E953AAD944B151BC3A26C3E0F3DB23C02CB615A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion discovery spyware trojan
behavioral29 behavioral30
- Target
  RobloxProxy.dll
- Size 84KB
- SHA256 cafe3dd02959b80fc2646fffa9b0bff79539d50b7cc4a63d3d36ac03bf1bdfdd
- MD5 41e7885a1ee56aeea7a92d37bce7c634
- SHA1 8abb5d1056ddca2dae00773594ceaeedeffedb97
- SHA512 0a63b76e96ef6600c63151fd2b5cd7addce935b73e73e275d213b56140f5af9d5d7d522d3e66b20d49437ad36108d108274d1d810336d73ae4496e5598e98bcf
- SSDEEP 1536:0JazIirBfyCEOC5KGTcPBSMgyv2J0ZsP7lO1Ax5PrL4HCvi/:4azIirtfCAPEMgyve0ZsPpO1AzrL4Ia
- TLSH
  T166836C61FB96C2B5CA8D153A1926D34E17BAFE508FD542C33E963B4E4D303C26E39285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32