Roblox[.]Account[.]Manager[.]3[.]6[.]1[.]zip

General

Target
Roblox.Account.Manager.3.6.1.zip
Size 4.0MB
Sample260620-ln9svaes2n
SHA256 1b94210a7a05ce8379db7b8c11d41f84bc868cbdcd0685733754728678bb5fa2
MD5 acc4818f58f1a1d2d2844a05f1aece19
SHA1 e3038c4501bb62415c18bfacca92167ebc4d623b
SHA512 1ca986d1ea6c8c87c590d891b3f29d5123e565e8ba2031728aa2c4b96892a18f00b478b6589ea73f056ec04ff0d07830fa5393c366eb849e80515971d6089207
SSDEEP 98304:Dqoll0wt/S7K8qqiJU/yYnjxFzzqmyFr+aEUqXfftI7kw1zsWf1i0SUxK:llzSu8/pHxBJITPAftI7kysWf1Vg
TLSH
T11216335E037C50A62B02E0D934B967216E1FEDDCD575C9CAEE621CEBC2820DC0977E69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
static1/unpack001/Roblox Account Manager/Roblox Account Manager.exe	costura

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Roblox Account Manager/Roblox Account Manager.exe

File Explorer

Roblox.Account.Manager.3.6.1.zip

.zip 4.0MB
Roblox Account Manager/Roblox Account Manager.exe

.exe 5.2MB

Roblox.Account.Manager.3.6.1.zip

SHA256 1b94210a7a05ce8379db7b8c11d41f84bc868cbdcd0685733754728678bb5fa2
MD5 acc4818f58f1a1d2d2844a05f1aece19
SHA1 e3038c4501bb62415c18bfacca92167ebc4d623b
SHA512 1ca986d1ea6c8c87c590d891b3f29d5123e565e8ba2031728aa2c4b96892a18f00b478b6589ea73f056ec04ff0d07830fa5393c366eb849e80515971d6089207
SSDEEP 98304:Dqoll0wt/S7K8qqiJU/yYnjxFzzqmyFr+aEUqXfftI7kw1zsWf1i0SUxK:llzSu8/pHxBJITPAftI7kysWf1Vg
TLSH
T11216335E037C50A62B02E0D934B967216E1FEDDCD575C9CAEE621CEBC2820DC0977E69
MD5 SHA1 SHA512 SSDEEP TLSH

Roblox Account Manager/Roblox Account Manager.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9
MD5 a057fae0c8c97ee6cf2c12fb7bcf034d
SHA1 64fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6
SHA512 447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200
SSDEEP 98304:b2bT1Qm7d9GP4i7q0LTWgtUmWzmSyZs9S8Z/LywnrSkqXf0Fb7WnhNMYkj7:4Qm59q/tUhzmS9zZ/mY+kSIb7ahNMYk
TLSH
T11A46F02A72A04334E5A7457404A9C1B59AFE7E396A28E19EE7C0BD9F3DF57D09830313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5454462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Roblox Account Manager.pdb

Roblox.Account.Manager.3.6.1.zip

Roblox Account Manager/Roblox Account Manager.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Roblox.Account.Manager.3.6.1.zip

Roblox Account Manager/Roblox Account Manager.exe

mscoree

dotnet