General
- Target Roblox.Account.Manager.3.7.2.zip
- Size 4.2MB
- Sample260705-18cq6sf141
- SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
Malware Config
Targets
-
- Target Roblox.Account.Manager.3.7.2.zip
- Size 4.2MB
- SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
Score1/10 -
- Target Roblox Account Manager.exe
- Size 5.4MB
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
Score7/10Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target icsharpcode.sharpziplib.dll
- Size 248KB
- SHA256 cb9c05b5a1e1db26ff43490ee26f2e02abae3f321d2dd5ddd43a68da48eab83d
Score1/10 -
- Target icsharpcode.sharpziplib.pdb
- Size 118KB
- SHA256 d14d75b91138cfda95c8396752c4935fbe8afdad12e026c0845899b460bf555e
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target log4net.dll
- Size 264KB
- SHA256 4ffeecfa1564bcd632891c7e0f376669227ed177e4f34bd8fb25f493162d8c3a
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target microsoft.aspnetcore.webutilities.dll
- Size 64KB
- SHA256 0f96a425e05decd3484eecc05f1957ef39768dfb1ce2e4cac9e10ac30361aa8a
Score1/10 -
- Target microsoft.bcl.asyncinterfaces.dll
- Size 26KB
- SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
Score6/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target microsoft.extensions.dependencyinjection.abstractions.dll
- Size 62KB
- SHA256 c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e
Score1/10 -
- Target microsoft.extensions.dependencyinjection.dll
- Size 94KB
- SHA256 18b39777ee45220217459641991ab700bc9253acaf0940cf6e017e9392b43698
Score1/10 -
- Target microsoft.extensions.logging.abstractions.dll
- Size 66KB
- SHA256 5907c585797617c998df0953d2a05d334a9d80f04a5c0bc20377725327e3355d
Score6/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target microsoft.extensions.logging.dll
- Size 52KB
- SHA256 c7756fe1d2641d905a61d11ccdda2acc94c3379a81ba5a280aaf4c1fe4f289ab
Score6/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target microsoft.extensions.options.dll
- Size 67KB
- SHA256 c9b11d696d9cfd6276dbb057fa9ed0787af16889e7ce0964460de9eea7cce8dd
Score1/10 -
- Target microsoft.extensions.primitives.dll
- Size 48KB
- SHA256 3c6ea55594433e2f0340227bd1588fbab1ba8a10c99319b528cc5573259340cb
Score1/10 -
- Target microsoft.net.http.headers.dll
- Size 73KB
- SHA256 751e6493e6e4ec1951f9cd7b912388979ca54ef33ecfaf1c38654e0b87a13993
Score1/10 -
- Target microsoft.windowsapicodepack.dll
- Size 96KB
- SHA256 808e96f59e7dd2212eace049079d25545f6c9c3f05244ec9cdc539fda18d34d6
Score1/10 -
- Target newtonsoft.json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
Score1/10 -
- Target objectlistview.dll
- Size 434KB
- SHA256 0b94b3824761723400dc0357e7d490085a5ccf3415e332155c5b8d6c7bfb8788
Score1/10 -
- Target puppeteersharp.dll
- Size 949KB
- SHA256 8811f681737cb47e9c72d0d984570206dc88e9112041e8d0bd3e501a0dbaeae7
Score1/10 -
- Target restsharp.dll
- Size 207KB
- SHA256 0cbe7c6b83c1d6256f6023c8c795ec2fa94f867ba3345bbc778adac8921c9d7d
Score1/10 -
- Target sodium.dll
- Size 59KB
- SHA256 bf5b02ac516e9b62086649f43a29287c7872bbdb87512e9d5ec1be681c77a94a
Score1/10 -
- Target system.buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
Score1/10 -
- Target system.diagnostics.diagnosticsource.dll
- Size 184KB
- SHA256 c8a5ca93d8e40dafd48759226f70f90af8ccbc3a8df45d4e6fd5dc5626b05ab9
Score1/10 -
- Target system.memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
Score1/10 -
- Target system.net.http.json.dll
- Size 71KB
- SHA256 56f51736571f694409acaed608fdd4d7bf55adb00e72bc63ec73d08e43d8acff
Score1/10 -
- Target system.numerics.vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
Score6/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target system.runtime.compilerservices.unsafe.dll
- Size 17KB
- SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
Score6/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target system.text.encodings.web.dll
- Size 77KB
- SHA256 e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
Score1/10 -
- Target system.text.json.dll
- Size 628KB
- SHA256 7eb217f0a0b9fe681de288511cb230708bb1c66e0c4a8553b9c0058632cfd20f
Score1/10 -
- Target system.threading.tasks.extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
Score6/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target system.valuetuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
Score1/10 -
- Target websocket-sharp.dll
- Size 221KB
- SHA256 697f13f09cb2c425ddcfe1aa167d698f7af5aea48d03d5370143bc00e9bbfa2e
Score1/10 -
- Target yove.proxy.dll
- Size 17KB
- SHA256 0484e0b4de32793c814115b44defddd6a646ba601ebeeb963b51b9146b514a75
Score1/10