General
- Target RobloxSIG Leaked by luaL_reg aka timesecay.rar
- Size 5KB
- Sample260620-aks55scs8p
- SHA256 120ae9b2e50d03fe799a47535a205a98835d791c877b1127ff9dea41b4c31110
- MD5 d138bea9b14f02a27256016b7b650732
- SHA1 27a0629a5b5a857ba311846df61175b4c42283b7
- SHA512 028f54d29864f99a79e14a5a86ced042e40cce82ef2b83b13762530009fb93d567e455666302a75a678b030d87441c85985fd6c217bf70bbb9362224e1012142
- SSDEEP 96:ZSYynHajE4/zuDlihjmUd2QgTk9eTpiK24s7kTd7KormLnTelXNSjNVRIN5M:cnHa44/6ZK8Qg7OP7Y8No5M
- TLSH T104B16CC8D666B00E2EA60F85631A9F4520982C9DB9C79149EA34533DCD0B0597CED6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
RobloxSIG Leaked by luaL_reg aka timesecay.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
RobloxSIG Leaked by luaL_reg aka timesecay.rar
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral3
Sample
RobloxCorp.crt
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
RobloxCorp.crt
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral5
Sample
RobloxCorp.key
Resource
macos-20250619-en
Behavioral task
behavioral6
Sample
RobloxCorp.pfx
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
RobloxCorp.pfx
Resource
win11ltsc2024-20260617-en
Malware Config
Targets
-
- Target RobloxSIG Leaked by luaL_reg aka timesecay.rar
- Size 5KB
- SHA256 120ae9b2e50d03fe799a47535a205a98835d791c877b1127ff9dea41b4c31110
- MD5 d138bea9b14f02a27256016b7b650732
- SHA1 27a0629a5b5a857ba311846df61175b4c42283b7
- SHA512 028f54d29864f99a79e14a5a86ced042e40cce82ef2b83b13762530009fb93d567e455666302a75a678b030d87441c85985fd6c217bf70bbb9362224e1012142
- SSDEEP 96:ZSYynHajE4/zuDlihjmUd2QgTk9eTpiK24s7kTd7KormLnTelXNSjNVRIN5M:cnHa44/6ZK8Qg7OP7Y8No5M
- TLSH T104B16CC8D666B00E2EA60F85631A9F4520982C9DB9C79149EA34533DCD0B0597CED6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
- Target RobloxCorp.crt
- Size 1KB
- SHA256 26e1a099cee323d3639cb05a4cacdfba97661b461a737ef80a63d3263e1b6f49
- MD5 184d30f698873305eae277ddca706aef
- SHA1 4589ec98cfebeb164524510fe55cacbb57473b91
- SHA512 53375503ce5d484c6017b99d49f0a755e34b161fd2b026a09046a5576bfd7b9a29fa3cfbab8f4ec5ffee81655bf185e85be8df258348f500dd6ae8a23c1bdb32
- TLSH T195310AA58DF10D91A8AFD0C8F1BF12100C04417067A997776D973C8557FA9A5222C9DD
- MD5 SHA1 SHA512 TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
- Target RobloxCorp.key
- Size 1KB
- SHA256 16f220a0260627e4a636fbda470e562e91bb1edae52e8484cac89cd0bc640283
- MD5 ea9ef52925dc4357848ddc79af72df74
- SHA1 d193c6206b6e7193cb5562d2734b680b93eb36a9
- SHA512 f11e04f042132e8b7b20348ca15b515e8a03226065ce6255f994e3a315aad541e0b4251e513db2b1362719a4a1efb1ac63dbfaac0bb12895f5f86a25d5258647
- TLSH T1453128840D811E614841DAB49EAFE3F53B282F7FD60E43DA36D81AC215745A4147FECA
- MD5 SHA1 SHA512 TLSH
Score1/10 -
- Target RobloxCorp.pfx
- Size 2KB
- SHA256 bc571b98e1997baf676c96f59ca2313fd8922fd511ebfcd8f0cc0685b9b317c9
- MD5 4b57d454d4adde2c8f6f774bde0e505f
- SHA1 a9bca246dfeff04399394c561aa268dd8ebb08e0
- SHA512 67e44f45065fcd1126044366ed0793d100d8c6c5c2e3434f64f8f6b917c055764dd6bcba38e3dbb97238b91e4dad6afa949edd06d058151715322056a9deb6c7
- TLSH T10F514EAB516E4141EF28DDD68C8E6B8541D1D34578C29B7F72E0B6C30E65B13B81F112
- MD5 SHA1 SHA512 TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory