e0f43e3074c9f695190c457dd978d6b703b35256d2562c164f32e5559bfeed1d

Sharing

Copy URL Twitter E-mail

General

Target
Roblox-Client-Tracker.zip
Size 3.5MB
Sample260701-g6rb1af13p
SHA256 e0f43e3074c9f695190c457dd978d6b703b35256d2562c164f32e5559bfeed1d
MD5 80fcd518e84ae7b9334785e62569b3c4
SHA1 25343eb0395c83068602151b2bf1fc8345655773
SHA512 6cd6d0191afb45b922605635152e69c2940e97fa5bc82aabfb42ba2cb0a3157a672d10d0c0827cc767be39725e6117f1d3224c18654a0c88e09e956e2f956ec7
SSDEEP 49152:llezEKiv/eyQVQi2uMaU5pF7yzBfD6WMxTBM8UfYC2H2dSHhigix:llS67WQi26cp5yzBL6TxTBLUAlavB
TLSH
T1B60633E4E233EA83EE98007EB3766D622D5C72BE0818A306367395D44C49735159F9BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Accordion/Accordion.code.md
- Size 3KB
- SHA256 6f80874467afe6da311dca78e0a783af4cb500501e4dd4c591328a698260421b
- MD5 a1987ac95496d1b2932b9235d616eb23
- SHA1 c161da62eb57e5fd422d22ff6e252eef984ba788
- SHA512 1b6f46e5ac4f42d4f8d606259cf71c94d97feeec170e46bd63e699b688f96fa6c0d9e169ba8d09d63e7ae3e6e330dbf69ac0910a2779398251ab7443fa9b87f7
- TLSH
  T1CF710E3520550264125BF0AFAFBE6D1EBE182007B6993D64349C849C3FBC11F96F87AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Button/Button.code.md
- Size 1KB
- SHA256 48090de2de85a9a40f25795c1acf83411d3802a78bf3d5763245d9316672aa7e
- MD5 218189005df802c6b30ca60fe6623c21
- SHA1 670f78261e6605dfd8ea14d462d8447c67dff010
- SHA512 834a7870e13db47cabbf753ad8f12bf15c78fd2487d7c1145740a5f078afde236a96fa8ad3a1ef7486558f1d763f38ca8f2648e5f789fbfb184439a89d7211e5
- TLSH
  T14631E2BB32456328D7311022F56F71C4AB019BB43775FC74508D416C22F99AA41FA6DB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/ButtonGroup/ButtonGroup.code.md
- Size 3KB
- SHA256 917550d6aae6f564d11950be44bcd21e72d17a9c4d89afef321ed22690183514
- MD5 9ac24e20d98af714ae1578b8bf1a41e1
- SHA1 2c399e21dc6b35264080e534e6ba175b1b37f6b5
- SHA512 11d97063406660eb00cb9eadaa1264fcc881c469dd08db2df13f9fcdbe5e5242c5713558b307a89bb92c478197ebdf3f94c72fe298339a126a6a82771655dfe4
- TLSH
  T18D61CDFDB0A1358CAA2330B7D46B2016BA2592E76F557C10720E63991F9C40D92FA75F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Checkbox/Checkbox.code.md
- Size 737B
- SHA256 5440cf5b578719c8467e9fb70ccff65d9c1a8643bf4728e71c3c5b88b6af2c17
- MD5 4b8e624d85efd8aa981bc2bd442f1585
- SHA1 8cb69ef69e9c548baeaef038bcb452b833c29918
- SHA512 ed32d3c481560ca32afdc11ae4fe19428e1821b704c7782eb800a2acc4305caaab6650c05874b745e4ea9c48fa1962fb2cd40dca2d62d0a5286fd83ddbe8ff7f
- TLSH
  T16101DC3B385933AD3B320183E56E09A76E3489D021A552B482C2D81C60EEEAC42EF75C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Chip/Chip.code.md
- Size 1KB
- SHA256 07d90836708e09c7fb6a5588aee6991687c3db5b720b2b4fb47eb729a23e328e
- MD5 b2708b4e48dcffd1ad62eceb47fc62b5
- SHA1 2b716843da3c01921c349cb6f9a6d719b0e6e2aa
- SHA512 0ac5cc43999caa4dad6c70e3a6bbeb2a2bdacbee47bb7d5d84b101663910bc72cad487e7fdf5eec26fd895ea77abd9f794cad39cde3dc7c6bd9ce2a1c776945a
- TLSH
  T13721121E31DF50C4E6171097B1F56353781461852F98A870F48CC0B92B1449E60FBFED
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Coachmark/Coachmark.code.md
- Size 3KB
- SHA256 23cabe6d1e801e9a2bf454b6bb827ead7f7d422069577902c97309e71aaa699c
- MD5 b985e6634e51090faa8b0affb289a3ef
- SHA1 0091c015c644b4cdaed6e6033921ce791d14fbe4
- SHA512 a20fea8f80001d317db32c8917d17d564b92825032c32b01b8a65c7e05153b26be232f31afc479b2cb70db88e38f3545c453d40a99b301bc8f1f4506f59a46ec
- TLSH
  T1B681976BE11D139C4267205FE05F52E5BD3D526AF39130FBA089419D24ED44683EE987
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/ColorPicker/ColorPicker.code.md
- Size 2KB
- SHA256 2a334c7991befd9b0a3729f72cc310bcb554f1e84c6f8d6aa4889fcb7a637080
- MD5 f2d9b72504d9b456f12fbaf58ec7b8e0
- SHA1 56d072b148f71208ec4153a2383d6baa79b4dc0d
- SHA512 8ec49bf82af018154eaf8ae77b056ba62973e8590b501fbedbfeb7fe5ba08a26ef0a1b4623d4b7140d30a4c916141936ed8722aaa63310ff9fd950fd317851e0
- TLSH
  T1BC51973CF29636EF053F00FFB49718986D1B3A5451C805DE6622529C93D809FC2EB4AB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dialog/Dialog.code.md
- Size 5KB
- SHA256 4ca59702a0a4057e22f93f2d3daf9b966765352506a69ee037174db06ddfe7ae
- MD5 6ee62de9cfbcb1975761c93781b9ab0f
- SHA1 1442c6e805d330604bc858d766a88733aff19d29
- SHA512 1aa082de7273417c27286bad63be147595f0383f889bd71d6c0f04d6fa784ae93c46b1f56057df81c6d10adee4eb909d59e081ffa6e6003ef9e4b782c96754d0
- SSDEEP 96:xfmHuGA1OS1V6ATWgenASXhuVFCKRKGSM+pt1w3hXC1dHww1VBMppHJjqIndL2KR:Bau/1OQpTWFnASETEM+pt1w3hXC1dQww
- TLSH
  T137C18769B14D22A48F97267B6A6F01C2F23C512123193974348E52EC2FFC82D62FB5DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/Dropdown/Dropdown.code.md
- Size 836B
- SHA256 dc6be58ae86485196ac7d1165d9f7ea5b9d75db8e82c3de1e425e7025b0164c5
- MD5 871d247887d83fe8e65ea8f84462e3f4
- SHA1 3ecda026f6ba49fb38c17e7e02534741fcf3db89
- SHA512 d7b5db51deed7c6a6332b24a1688e9aeac4476dbc9f7d120823c3b7aca7168fef41082c3a01f55f16e5b47694aa7398432ddfd49269b56584a96c24e451dbd15
- TLSH
  T12D01EF38918977A1838B20935CBD30C6AA118215E486B6E1F14D42EC135662CE2F3DDF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/EducationalTooltip/EducationalTooltip.code.md
- Size 4KB
- SHA256 532793a61ab81914e76b77a1b7d590e5baec301253ae2da5a5e0769b8151904e
- MD5 caf27ebafd42cc7f19aa03a1bf76a794
- SHA1 ed6a99c78bdb4f0586b03b54523b21e9d024a32f
- SHA512 437860af354fcaf3f27d1022f939f58f72ff707c9308930477f6aa9974e9bdc6e7e7ed13eab1908217f275235a43873463a28ae685412dff762d3f16b219c024
- SSDEEP 96:VrmHGK/SG/7ADuqRB0xSyGJ7MbjFziYRh8L+ZDsXixSxSs7MD:Vq/7A6qsfk7MbjliYT8LIDyiM17Q
- TLSH
  T1F48156ABE12A139C436B201FA0AF63E5793E516AE3D134FBD04981DC159D40683EBD8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  LuaPackages/Packages/_Index/Foundation/Foundation/Components/FeedbackAlert/FeedbackAlert.code.md
- Size 1KB
- SHA256 8b0ca28998673c0e0c76e54261b3d71d460e70392b6257e1391276969fb5affa
- MD5 dbf4815247ccc22cefcd42fa6a2980d5
- SHA1 d2c44d38cc8ac5df58b9c41685883018086f268b
- SHA512 f83210700e7a5eb3830280360338a3ad81f62c66d274e924e9bac532958bc0441ca607f338e3c82884c88ecad74c7a4f0bdc99cee8e88dde75dfda3ba86574cf
- TLSH
  T17431216AF20A2658279360E9D42F72912A3CD0A57DD17475A44F13DC11AD60CD3FB94B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  MpDlpService.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23
- Target
  mpclient.dll
- Size 3.7MB
- SHA256 90c5ca87d0fe3fa240b01af3c85adafd9f90e841204cbb122c6a538a2dff6757
- MD5 790145cd39af7feeb893487af476e6dc
- SHA1 28b95a45c9a3b289d491f581e368280d85127565
- SHA512 779a14d610c53e6f866f4c574fb1d5c2a71043bbb0d271a83a543eeab04cb1a649c538e14c11274f2bfc0b993325548e6f7c5d2e979134cfb1cc49e9150f271c
- SSDEEP 49152:oN8L8xfIx7vcupLhK3LpHDgeTZ3UOu+ab6u7jlHH4ueac6IpIEd:oNj4Zhwdsj8JyEd
- TLSH
  T14F068D43EED098ABC499A33289B692417B3DBC491B3227D72D90B7772E777C06836714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral24 behavioral25