General
- Target Pay 5000 Robux Ransomware.exe
- Size 584KB
- Sample260719-w4fvtabw4s
- SHA256 21015517c1ced96b58b6597e50d1805610b48292cfba20c730ae69123f15d684
- MD5 8dae31dc9349c0466dd5716629086efc
- SHA1 10ba027460e9a4281271d644e09ab65e93df3d1d
- SHA512 d2f3920337c3313d98413f77c3af98320abaf22763aa169739651bcbbe8cfeb528a6e2db19afca2f1a27afa291146a77157c6048cc64980fbf01f4c94559c486
- SSDEEP 12288:egVnZB7EmxB0QnEhCZeCE4Va9lOybpjLMvL+WQoj9iTgEVcfMbQjTph8Q/:e0nn0QnEgeCBVix0ucfdv8Q
- TLSH T1B2D4234A6DF9E12BC0258B3D9A1F99C2071056D5DD12F2E77C5893220BE6A644A0F3FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Pay 5000 Robux Ransomware.exe
Resource
win10ltsc2021-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pay 5000 Robux Ransomware.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
Pay 5000 Robux Ransomware.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
Pay 5000 Robux Ransomware.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target Pay 5000 Robux Ransomware.exe
- Size 584KB
- SHA256 21015517c1ced96b58b6597e50d1805610b48292cfba20c730ae69123f15d684
- MD5 8dae31dc9349c0466dd5716629086efc
- SHA1 10ba027460e9a4281271d644e09ab65e93df3d1d
- SHA512 d2f3920337c3313d98413f77c3af98320abaf22763aa169739651bcbbe8cfeb528a6e2db19afca2f1a27afa291146a77157c6048cc64980fbf01f4c94559c486
- SSDEEP 12288:egVnZB7EmxB0QnEhCZeCE4Va9lOybpjLMvL+WQoj9iTgEVcfMbQjTph8Q/:e0nn0QnEgeCBVix0ucfdv8Q
- TLSH T1B2D4234A6DF9E12BC0258B3D9A1F99C2071056D5DD12F2E77C5893220BE6A644A0F3FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Sets desktop wallpaper using registry