9cbf5b75065b830b5d5e38e56c9a642ac03f3f8849eedd67612b0e2f1a827dfa

Sharing

Copy URL Twitter E-mail

General

Target
MultiRoblox.exe
Size 71.5MB
Sample260506-e857tsav2y
SHA256 9cbf5b75065b830b5d5e38e56c9a642ac03f3f8849eedd67612b0e2f1a827dfa
MD5 39744af025ad9c76604bda9297937ce5
SHA1 a97404350d7312305fc104b6b97bac0ebd7afed3
SHA512 ac631b590ceb68e0b2a531ad9a2a2ce445e7d3bd2c9eb0a6b908798ed50faaba00218d232fdadfec5d5066c355406f1b60906e0d9d4a61d84f715d2ebd071a3e
SSDEEP 1572864:9IRVK4Dqx2kjGqjiqEeyh+qQ4WTnW2DNC5zdALoTp27:qRVB9VWTW2REdC7
TLSH
T1E5F733189C2C4A55CB2DCBF084895AFAC4983BBFF930D6103290FE756E5B3856514FEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  MultiRoblox.exe
- Size 71.5MB
- SHA256 9cbf5b75065b830b5d5e38e56c9a642ac03f3f8849eedd67612b0e2f1a827dfa
- MD5 39744af025ad9c76604bda9297937ce5
- SHA1 a97404350d7312305fc104b6b97bac0ebd7afed3
- SHA512 ac631b590ceb68e0b2a531ad9a2a2ce445e7d3bd2c9eb0a6b908798ed50faaba00218d232fdadfec5d5066c355406f1b60906e0d9d4a61d84f715d2ebd071a3e
- SSDEEP 1572864:9IRVK4Dqx2kjGqjiqEeyh+qQ4WTnW2DNC5zdALoTp27:qRVB9VWTW2REdC7
- TLSH
  T1E5F733189C2C4A55CB2DCBF084895AFAC4983BBFF930D6103290FE756E5B3856514FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 10.7MB
- SHA256 2f9bd7e8103b2f509abfcce2eac0a9e6a5e367987b8167dac612fd36fd3c0d9d
- MD5 b00daaa4e23ccb3860d572a0a73606eb
- SHA1 a6afe0a0dd6e469870f23a67652ace635879225f
- SHA512 9cc36d01722521bddda0e4bcc1ed14533b2af3e0f2548000cd0e71ce413d7b8fcb5fcdd997f32b70cd1f81dc32bbf59452a4d8ec19ad95ed70c0ae836332b39e
- SSDEEP 24576:2o9dQj6poj6j1qjK6DZywRFXTvmf4KjZ6ojK6QjZ6UjK6ajK64jK6ZjZ6ijK6e6Q:By8eGp
- TLSH
  T18DB6A42F7B48037706C602A2AB8B65CAF31F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral7 behavioral8
- Target
  MultiRoblox.exe
- Size 181.7MB
- SHA256 01fd5875b35ee565b46404c9fdf69e2d6cf20449eed999b0b1ad4896c4f976aa
- MD5 16e52e1b60433ee359a2c64a97255b5a
- SHA1 a933bf6167a402bb1e883210859d7f5b6a764eb5
- SHA512 2888196a7667e59d01b50fdb2aacf61487c21aa913c434527cc3bdd29910ccce612bc49a82619a730e172c2ab8d64f23e1db04cbb31d2360b66efc54a9f34085
- SSDEEP 1572864:tNKPIpfjC6kkZAC2TjEtxhyd5j14HbD6OaFSxqVUeu9Rq29EmoH7SesWVYpap+4Z:GY65t4TV
- TLSH
  T1DC988C03F39A40D9E01DD1758B8B9633EAB1B8854724A2DF275407562FB7EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 62937d8c1c2f7924d7369c08d15f8cdbb7dc4d1bdc5618ff5603fea873343a6a
- MD5 a31261d492e1663b1c15af4090c9d287
- SHA1 1c2982106fd99be54344ecb52f0a42827fbc164e
- SHA512 7de4b30355600f24f34e387b7d367e64c0a01e4028f55200e1c39e4b5e36a621281a5c167cda4486bc61d196375a7067180c1367a304d26f055f1dc8aee23841
- SSDEEP 49152:giWa61V7iv3L5LlZ1rpkKzYNOA/7ZnddK6BfeLaSHAIeSR3KTw8:vGev3LFbgKzYggIe8K88
- TLSH
  T16CD5BE03F6DA50DDD029D470979F9213F671344A8F1166EF26A05A202FA7FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 479KB
- SHA256 bd174fd289918d12e3d4ef63f5243e259bdfcef1aaab3613681544d2ef7e1efa
- MD5 fcc0a5c3d96a655a4f0271f18edb4e9f
- SHA1 e2cf48f1724d5210691ba75c30f608df95bdfbc9
- SHA512 4ba7d28dd6680a7696ac80df90cbf5934ca5534878b3b6585f085ad3e7dc04a6c9dca463b2a4a7af383a9b0bf0c9041da8aac3e556ebc3987bfacc07a8cb2405
- SSDEEP 6144:Xpf5tkRT05pU+7XmpChszWpTRY6CIczyj+ww4NZ96gRO:tx537XQChszIzCLyj+ww4Ig
- TLSH
  T155A49E15B3E444A9E06AD174CA534642DB76B4960B29FBDF03E492392F37BF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 66788a90b70bafbecb5b1292ed83d98639b58a5b1a5c090170f7baff59da023f
- MD5 3cd55d16c2a54b81f3a3a81dcf15cf73
- SHA1 83ce14ca1c117ff9535da6872d218462c502b3db
- SHA512 e40342b38b71b50b957544c0665c3170b065755d2fb718c4d2d4ddd1a13a6240c8259ae54ef6fda043600eb324ed817f96ecf79d773c9285278e07822d3c1ebd
- SSDEEP 98304:8q/cBzNls5GKtT8jbjevNn+y+vrrXgJooioooooooooooooooooorooooooooIn7:8/sAMV+n47
- TLSH
  T182867C03F79640D9D00DE2B8C75B9623FA3578850724B6CF269457252F67FE0AB3AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar
- Size 140KB
- SHA256 88446c5991a40b1f387e40ff2e6bdb9d2c48191bc873cfc0a1fdb235071b783c
- MD5 8e136734c6d928dd91c0bbb3e861c0d7
- SHA1 a272b9e6d027ab4db5db895c2dd8a1f6d2016ed9
- SHA512 2f4d2a763440ba975a9e586ab15494dec92695e8da60c1ba1d52977e961e5cea9242e8ee78e45bd57e8084d28e394d990cde076792493aef1f772a3c2cc66b89
- SSDEEP 3072:yzwyzw+YC0yDkC8By/7Zr9f9yGIwqd9W7z:ygokC8EUwqd9O
- TLSH
  T121E33AB171F420363573D89DA6AB971E3610B003F90AC684B69C71A44FCFDB58963AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  resources/mutex_holder.ps1
- Size 1KB
- SHA256 a48aaa833c7829a6d103cd60022421a0593182392d53fe11ef1431fe9380b892
- MD5 29263509d122a32fe60e2ac8e0654136
- SHA1 fcb88a174e467146492f9226d26ed066869e324f
- SHA512 35b1f517d7e493e6b30b340ac8787a81431f5d070943b2bdb5a56a88d530271e26858c98f34fc377b902ee566312a10cbc8cdbb6fe0f3e39d2c28dc50310e4af
- TLSH
  T17D21EF22FFC65AA01C5360214B6A35427A6A5A33129ED8A03DDFD31CEF0221954548DF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 bbed1f5b6c20266602188127fa5f5643cd11d6f5f20494ebacc49da1c0ed70b8
- MD5 b0c04842e116baaf600203e92d119940
- SHA1 69e23ac3d871883557dcadebbd2fb110de42a90f
- SHA512 6edd12d3808c9a2ec970ba238d4954a409fdb18cbc3d9b235b7f749b59b06be3c2efedc608f3c3aedb8facf19fd67409502fa74c4d84be6185083a5501c8e1d1
- SSDEEP 49152:zjtHPuQzKxUDrpspreFRHmrR5zLIOrzY/9G75d/9N4yyUGrWrw+/1SbJ/E06922I:1GQzcXpovSnXNk
- TLSH
  T17C463803B2858099F05DD679875BA633F632B8801B76B6DF52A01F192E77FE06739B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 876KB
- SHA256 de8802db77e0d421a8fabb636a7102fbac72d229b0a3e82d08b26812d36b3d31
- MD5 b5d3aaa65250e13e04b3171944c81051
- SHA1 34c45be968205c785fd515321d3f8f4ba800ca13
- SHA512 28d6d68418e28f59946a3bd4fab871e8b473150d26d03721a8697de36666231b9224c7a381084678ac0194d69a80d6a6c26b33e953b7ae1dbbf6bcc0e66fcc6f
- SSDEEP 24576:qx2LdDMxavyLgu/QYkiawQV6Z5W4DYsHF6g3P0zAk7oov:qcL+xa67/QYQwQV6Z5W4DYsHF6g3P0zO
- TLSH
  T1A0156C23E6948669D57AC034C9C24603C9F174922326B9CF02A85718BF6BFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23