f5a8ee6d9d34c47c89ba8ee4db1164c34f17095d04cde92d4dfacd595c3aecce

Sharing

Copy URL Twitter E-mail

General

Target
Client2020.rar
Size 114.2MB
Sample260706-xyqcqsf14k
SHA256 f5a8ee6d9d34c47c89ba8ee4db1164c34f17095d04cde92d4dfacd595c3aecce
MD5 055c396cfba45c3e69a95c8efee359c8
SHA1 5315d036bbe4df69c53d29f4a595397fdb9e7ac1
SHA512 697797693b93bf649b7981e0ab577a82b1fc2a2f7f7cf05d3293b04440e87f81f955b8821ee7dd0109dbd7591ac7495fae76c043627462d18c0a4c40c0c4e599
SSDEEP 3145728:oSQ/af77zgqeJ1SDlL41BvoUbv0crJ0ZI4Hhlv7SDK6:a/I8JsDlkBvoUbnrJ0u4H3c
TLSH
T1814833E073FB6CEF8ADB8235D2523682D139371AE4C1D0847F4A765E94E434313996EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/roblox_testez/testez/TestPlan.lua
- Size 7KB
- SHA256 ace0eb19bb5d407ba1d17a219fd0048243ab0d0fb03b7e92aaaf106a9afeca7a
- MD5 c75e896fc5c26b735067e22cbb021937
- SHA1 63f418a6a104ce139da2867c52f0ff052b723088
- SHA512 1e5fd78fb6780fe24ae7a66384f50dd132cf014d054f9a89650ea86ea33c954fa63c4f8a755ad62f4674ca1d1ac5c838c40122857bda0e2f6cda4345b69ad197
- SSDEEP 96:tZYpBuZArJeKOAlhT3v9zmliS+u8fvR8PSYUvmjQ8IADKsjROSirHyh6:spBuZE0KOA7FzmADPRo6BVYQSMHyh6
- TLSH
  T1C5F114A5F25727C73E8233E1543F8B6DA97AC5024C3C2295FADC87D920D0A5C865BDE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/roblox_testez/testez/TestRunner.lua
- Size 4KB
- SHA256 178d3e13252a92ac77dff7390f366185d5231042d23abda886ab5069787775a4
- MD5 b0b4b89c7edc79752389aa12ead924bd
- SHA1 145865116f16d708dccc0e1777e9bb428e3b8a56
- SHA512 29214cbd076162eda2338bccffbc6ee2cbc02897bfba782384b2c9d5f21bf2024b513781318e5c19b06d5747a394fedb36bcd4265977381fc52589b2091b2f7f
- SSDEEP 96:09irZTkcwoun5z22eEzVBP/VzbTWPmhV79yw:0h/oM5z3eq/VzbqP0vyw
- TLSH
  T140A1845AF40F16F76E05B286F07D7004A7BDD012A13A2264F4DDA276B3C0B1D9997BE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/roblox_testez/testez/TestSession.lua
- Size 6KB
- SHA256 d377ad218f4790f2aa204e00a89171f07aa3e90461920a5798bc36bd48fee769
- MD5 bfef8e86eb349a31a335778ef8dc1d85
- SHA1 b06e3612fc1b5e74bb064637ea7d7b0826a86840
- SHA512 201f35e900797e88f4f143c115f3d33abf79c2b5f59fb72d38c2ddd3101a85a1b51f506c6cd07e78bd8d13c3b304b7ade4b3079f86d4f5706accf5f2ecb0b073
- SSDEEP 96:Xj1R5ZTmVKfVaHSMY6HFOFJ39J03GBF7R6Pd9P:z1dCHOL02F7R6PLP
- TLSH
  T1DBD16064F8266BA6BD811597F8F6D070BE2ADC14B63E1021D0FE40A952D0E7DD26FDE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/roblox_url-builder/url-builder/UrlPatterns/CatalogUrlPatterns.lua
- Size 976B
- SHA256 ec7f8a16dbcb6fd698bf56fff56929cc189e0fcdb9eb1171540ab75c33714f20
- MD5 a0edeb49b6b9d3a4a357d546e3f2ba49
- SHA1 3f2f1716d648479426654adc14d754e17d483d85
- SHA512 a8c55bb3e9d3996d43463bd1f17cd240c392a90ed5a1474b4271da712ae9af2e3ae732d07c48068ddac726189e08523b3001b9bf2fdf9c9ed42d1702239ff054
- TLSH
  T16811ED49B44FA456615B21686033D43C8A4FD7813C3AC0A2FAE92F1C3B29A04653AF7F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/roblox_url-builder/url-builder/UrlPatterns/GameUrlPatterns.lua
- Size 2KB
- SHA256 e117943e44c6abeb49c7426b990a76a1de872b563876fc7710faac89fee4f86e
- MD5 97bf0125e2e20d777d5c60e425a55c76
- SHA1 cc1e3747c367d8b4fc2892cd28d0c545846d13df
- SHA512 866323f400738b7e5f39cea9a5ca6e0c60ab5d263b6be660bacb179c02fab88b0ab91b5a1fa8009bc52ccd2f06280083eb63ff482d4cd9b0cedf436ee93eb6c5
- TLSH
  T1A3518924F1472443902B64969033FAE8572A8A513FF181A9DD522A2DDBB898C583FB5E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/roblox_url-builder/url-builder/UrlPatterns/StaticUrlPatterns.lua
- Size 1KB
- SHA256 34ec953b94f4aa5fa6ceda1c5bafc1dc41468edb86668f9c3ccace302061e385
- MD5 7738da7f8f2f0b91b66b339ef75e367c
- SHA1 6696a8099d8a6df4b241e074aee171c942a7ac13
- SHA512 4b972dac118938c8c2b7a11ad58baac2170c36135ae3da8676e7b879caae3d15a4b4fb09881cd1eecda38f0b771320b5f5f003a4cdecf946385cdf361352ae3a
- TLSH
  T1B34102753147B4C5E98E9980E432DA26576BCA323D7688F1DCC7025EA3F0507843FA5E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/roblox_url-builder/url-builder/UrlPatterns/UserUrlPatterns.lua
- Size 887B
- SHA256 9ec1b5b0cc2d01010301284d3e7e345378e68df710d507b860adb138c68a81c1
- MD5 6a58df8dd66654d17c259c32d8338da1
- SHA1 534150896993fe40f24d232eea7bd7ea9c8fdab6
- SHA512 e400b9e14983eb6e9e69ff9560d0d821384cfc7b29f832daf81ab76ddba79abc45bc5ef7f9771e922c60f1d171492eb72d0a22fe5dae8bc9489dff87e58c142a
- TLSH
  T11A11AB70728BB896E11B66408135A91123B7C5613FE944E1ECA3020D97F848780BFB6F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/Action.lua
- Size 1KB
- SHA256 f82e3b36d8204961ababa9be3cdf3304fc531871e0b59524a172096fe8222509
- MD5 d8386ca6b9d52f480fffc4aa647d3501
- SHA1 a42bcd984e0b733d85721a0256f129a3941bc9d9
- SHA512 a99e908b36895a94fd622edeca35131dc498e223f46b517acf82555e4ad75db2c26b5f19f7922ad6f70ec12e7eb2cfeb254bd67f99e0058f97e7119c7efb7076
- TLSH
  T1613112A2F647B3A14953323991BF94C5FC7CE420272440807898906D3D76A6BC57BEED
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/GET.spec.lua
- Size 604B
- SHA256 63ff4b9de2665829bd2a133278be7d51eee3b47a42048a99202fa95da82eee2a
- MD5 41264710cd746ad28aab83ed78041cf7
- SHA1 58358b6ae0fb5a85aed406bfcc09fb519a179224
- SHA512 7322aa46273bbe5bca999c521eaa4a9a6d8009e71449d3e847348f4b71b81ddc54727b40324f51af38ac804e8bc82bce8cc4351bfc1298141684a961c16c1053
- TLSH
  T13EF02D6DF2877001D58A3D95F83B4544EC2FD041317D695474C550BCA1D5A9D5C77C89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/NetworkStatus/EnumNetworkStatus.lua
- Size 431B
- SHA256 3eabe75a8daaa45c0f9b83c66899dadc82576b53022078db2c26b45036937ae7
- MD5 7c4c1ad7c382374050ae94da6c48b66e
- SHA1 81aa509ff7d68875216cf4a8a48f68b6a822cdbb
- SHA512 1a3bf63d3bef43abddf422b386754436dcdeceeefa6830120e94058c01f8e5dbfb65fc54bfed4bb6b7efc40a410772ad3d9ec29e2199a5e7af0cfde5dbe7f157
- TLSH
  T136E02763F09254C6BB2013D0523A9B00EC1BE5A1715B02FE5099530850DA40EA09FD9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/NetworkStatus/installReducer.lua
- Size 668B
- SHA256 673fa1519ce542d1c8fb6edb56d011e06d9fe7f50097f3be5a6ff704aa7a7db7
- MD5 ab793f280246317f90f8dde5936f907c
- SHA1 d62983ba90045464da5a58b85e13075ab5bfb55d
- SHA512 47f0fa6badba419bcfce7dfc3fc64d022340b6a8f77a19b377759ce1c7724720e9de8aa9d8697de5597b85eea8448bc625a26360824b83f95fcf3cbfadc88e25
- TLSH
  T1EB0120F8FA8EB064AE537598C47B41C4FF3FD831112E1410F09580A955B41ED856FDAD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/NetworkStatus/installReducer.spec.lua
- Size 3KB
- SHA256 00dca8777a1dfef407ec7c9518445a56573e4a0f30bdddb45a2ea32227a93a01
- MD5 e9115d0914764995d7e1413407d76ce2
- SHA1 4b5b142b7432c8385a695250ad2e592bc86c2404
- SHA512 91ee756135848d995e98ed246215064a14349a251fd55fd446a063bf5ffe4a68919ae7addf306004aee24335fb272912dc191f1f6f4596319c571e4de069cda0
- TLSH
  T144618BE9F98F7512C90336ADCA3BD084BD3FE421B22E0924B4CB45A8847519D960FDCE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/NetworkStatus/setStatus.spec.lua
- Size 2KB
- SHA256 9d8bc475779b53938bf1447d91c5c9e530ac2fe8a42113234a36af8bbd6efffe
- MD5 bd56fc366c12d77dd703c3724ea76530
- SHA1 9e2a7b2306f143636cba631ede6d26836d2f349a
- SHA512 c951ac3bbc805226f40c0480e0a92ad8a4ab2006f27836bafa9cf43a7d436545cdc8ef38d404791efffb00fe42c38fa110602e98062b0ab0503765047ad35283
- TLSH
  T1CC517BAAF5CF70E6CD42366AEC3B84486E3FD0323239192574DB146856FA5CC8657C8D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/POST.spec.lua
- Size 607B
- SHA256 b4ad04a9f8c3e04a810a8e0dfc1da6c452bf58db8d1f48a8eb543a5feeb24066
- MD5 6d3812b5e7c2cd455b36a84647dab0d5
- SHA1 0824b823d1cdef302d3b4ec76d920f8daec10834
- SHA512 61fa8dd295e3fcf589a46162cab6d6b66e82c6fd261916c3c243c2f53b7b4efadb5bcc7a255c1e38d4618653e688e7e885dce477b7f2abc5890d350ae57cb18e
- TLSH
  T195F02D6DF28B7002C58A3CA5F83B4540EC2FD0423179A95574C950BCA1D5AAD5C77C89
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/RoduxNetworking.spec.lua
- Size 1KB
- SHA256 b167804b1830f69a9a673ac557f34bb01b9ce47680e710e2c7af29567573d534
- MD5 2ceea007ce088f3af86bc0c31809adbc
- SHA1 ea3a660043e8518b63f139625877ac851dfc7e73
- SHA512 8dd94fb12335c6fef4a31cf3d9d9ac567f8d2c6277f20d37598f8fa823e058e8d670ba86702a8d5c97e081d05b55a680ed91d864bfcc2fbd42bacedadf01b528
- TLSH
  T13C319D6DFB6FB193D84A3691EC3B2615B93FC0E0B03D19B560CD42F01496A4D54ABC8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Client2020/ExtraContent/LuaPackages/Packages/_Index/rodux-networking/rodux-networking/init.lua
- Size 782B
- SHA256 77d6cc3fecc425dda38840ced5cffd07508e1e51f10949035ee9afd343f4b126
- MD5 26ad974198946c4e5c9d14779c341ca3
- SHA1 39616592326fab686f5dba055fd1558804b4b357
- SHA512 9aebf7b3951cfd918669397bfba133c29c4f464c589dd34d3d5740aa1e992ad178505403a14b72ebba8272ff2aa61e1bb33839464e38d34dfa13fd7f32e34250
- TLSH
  T142012B76FAFE6099DC413524C7327F007D5FC4A1941754FF8024039CB1D818A82BEA9D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32