47837bc154d09722408b50db2b34e26ce04b6286de7bebc86d6343debd9d6e04

Sharing

Copy URL Twitter E-mail

General

Target
RobloxAutoIP.zip
Size 2.2MB
Sample260728-vbvmts1zez
SHA256 47837bc154d09722408b50db2b34e26ce04b6286de7bebc86d6343debd9d6e04
MD5 d59674dbe2643792f242ee22ca7821c4
SHA1 4a6f1c7ea81a97ac61897f1c3dab215c808daf78
SHA512 06d9c684d5fde4b23a9fdaabd277f0eb5cb09153f899ae8fc5ca4c6a8bc8877d58e63679ad12cd15279b81c8ebb7a10c2f4739e31c341a352e60164155cb64e2
SSDEEP 49152:YY+92T/9n2Fv/x0hqWzQWHu2YOQGa/FdQ9XWIw5HNOhiomHTWCvjY0q:YO2FXChqW02VQbIXW5FNOQZaqjo
TLSH
T164B53302B8C7CFD665A2F551594E62E9BF662AC2B0C41ACBCF4394CE09F799F03E9141
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  RobloxAutoIP.zip
- Size 2.2MB
- SHA256 47837bc154d09722408b50db2b34e26ce04b6286de7bebc86d6343debd9d6e04
- MD5 d59674dbe2643792f242ee22ca7821c4
- SHA1 4a6f1c7ea81a97ac61897f1c3dab215c808daf78
- SHA512 06d9c684d5fde4b23a9fdaabd277f0eb5cb09153f899ae8fc5ca4c6a8bc8877d58e63679ad12cd15279b81c8ebb7a10c2f4739e31c341a352e60164155cb64e2
- SSDEEP 49152:YY+92T/9n2Fv/x0hqWzQWHu2YOQGa/FdQ9XWIw5HNOhiomHTWCvjY0q:YO2FXChqW02VQbIXW5FNOQZaqjo
- TLSH
  T164B53302B8C7CFD665A2F551594E62E9BF662AC2B0C41ACBCF4394CE09F799F03E9141
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  README.txt
- Size 862B
- SHA256 50d394662307236d6948d3b62ea169588a47b0d114ea2a4096b822af899604b9
- MD5 43d295823b09f34eaebcc2ab57c58d31
- SHA1 f44934a08c2c14a735040ed81f90ca2222965b1c
- SHA512 f79b3338f2c958c819b09d0f4f3e88fc47ce9de0129eceaa69f4a3cafaad8f106adf3660b979ce8b16b6a9995ad3a28da2c179fd13686cb6d0c6e6e261bdb6b8
- TLSH
  T1E111E323FBA29C96AE537270A50511E07BBA00C9237DD4F070AD765E1507083437DBDE
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  RobloxAutoIP.exe
- Size 1.2MB
- SHA256 5b074112b3a805e95c0196930afeb29bf058ee63f6dd7b2ecfa92b44ea628a75
- MD5 9fd7b0880aecc4c7ef5fc9a1da950066
- SHA1 09e1a297c49790b8ea9864d5d9c0346d2062d603
- SHA512 7f9a1c831b650412e9c59d11a0fcc72848b8e0aba328341d07c5de1ddda1f010e7e42dcd15a1a25e8b54a4e0591632fa153f1e41c42285ea496d55ea9c65c2ae
- SSDEEP 24576:gPXLUhGkdI259kyvmQIfo7HpjpssplzIAJPa8VCjI+LMDuu1VYDmJFgq+F:gPXybdI259hvmQIQ7HpjqsplzIAJPawm
- TLSH
  T11D556C0733A6C0E8DE6790B6CA25D232E6727C11072897DB64E05E2FFF93A915B36711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral5 behavioral6
- Target
  clumsy-0.3-win64-a/License.txt
- Size 1KB
- SHA256 1e6da68881c64e78707bba5acc6348dc51f4788e17e095cb516de2392c264e70
- MD5 70c373ee809890a3731b1d4231c5e706
- SHA1 0a1349f407b5d4a2747bf6555a33185751d9a8e6
- SHA512 da63ba460bd14db669ac533a37d36278112f47c6a67f8904dc65c8933cbb2bc92c5f3defdae051b92182f2bbe071aaa5f528c1f8764084db6b34ed37dfe0d975
- TLSH
  T1C421A71F725903A3194217A15966E8D9F22BB05E7FAF1A80345EF2085336018C9FBC58
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  clumsy-0.3-win64-a/WinDivert.dll
- Size 46KB
- SHA256 6110bfa44667405179c3e15e12af1b62037e447ed59b054b19042032995e6c7e
- MD5 88e1c19b978436258f7c938013408a8a
- SHA1 09b77c8c85757e11667a7b83231598dd67fe0b8b
- SHA512 eaa0d8369b76fd9a4978f14702716ae31d801cd0dc36a86531f9320b4ddb683265c4f0e07af2b9d2e85f513270d98d1b11ae7d501d08287442bc505176d16e14
- SSDEEP 768:itSVluu2agCfRSB3QEw2VWHxWYuaO6JXtltdUUwhqWB8TicI:bUZWECHxWDABdIyTic
- TLSH
  T13E23C703F64251BBC568C27083AED3526E22FCC66354FADF829FF7952885F42DB1A509
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  clumsy-0.3-win64-a/WinDivert64.sys
- Size 88KB
- SHA256 5c3e7bbb06ebb134bed7b1231fdf3139a2052cbe5e8c8418e54237933b51bb4e
- MD5 ae66b5b024e79f8b158bbedecd75f71b
- SHA1 72abf8ea3b82eff3c7da99500afc87670bef9c82
- SHA512 cc3657299118b7bb6537bff4ec0389b97d6ef5b351db5fd023787a64ca6b98062c6fe06a9dff8aca82fd0cb4532d517509b2e36247fa0b9de3116203b2e3ab47
- SSDEEP 1536:7ovgCRgYL/h//oJJw5AdPtey2AyWpdsimpxpWXixv6W:74jmJJsKle9A5pdsiypgovl
- TLSH
  T1DD935C46A2E201C5F9F6C97895B59253EF31FA91AB22C7DF11D0981E4F21BE0BD78321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  clumsy-0.3-win64-a/clumsy.exe
- Size 1.4MB
- SHA256 088d012a3d2788f797faf54d4f3db945c84ddab03a656c24d3badb06ae74324e
- MD5 e08b34a17ffb179d98d3452107e07189
- SHA1 f89c80d58497e88577f77d21f44c08d0ff89cdc4
- SHA512 e3dc85f8134fd09a725a0081efbb8816b82e61131e6c98882dda44b10467f7042f6bd9b30854d4a4f8c6e0449132b8d27aebac58fed2c15fc7dd81178db63d5f
- SSDEEP 24576:qjp/TkhdH/OHW2Cq1aaIQtGymaADRQpNBmCD:ql/whdYcqUAG9DRorm
- TLSH
  T14565D617E253959CC96AB1F1956AD2B1A420BC1016207DAB29F0BF273E71993CF2FC1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  clumsy-0.3-win64-a/config.txt
- Size 1KB
- SHA256 2aeef9c98ca46af303fdf3224a1ba2e0d8e6cac64dd64ee266731b912eed9c35
- MD5 c49890207b7387317804fb8f21cb0b7a
- SHA1 530ea79adc8e5f8a6aedc31261bb3d5e96b148c3
- SHA512 2d35ef659dd2ff03382f002fb0c737c951b77326714b754bce0135517a17727760b65fdde515fad5ec8c3b4409d3d8e9a8b49a6868603658488776ebac74054c
- TLSH
  T1672106577BB6528E2C782529F5DAEE400B4581183516FC8F74FDD1C65701E777D23248
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  sounds/activateSound.wav
- Size 18KB
- SHA256 f5ea576e9aaf2e5d5d46425026ec79ccc6fe88d00b6cecdb656ef2eb2deceba0
- MD5 a6521e11a2b0251f81c4e3b67ebecc88
- SHA1 c2fd3d6a18b9b0c3dfbe639418b88ac21e9859a8
- SHA512 3b0bdc1e082e6dc52eeabd33fda7cdffafac964c7a26d99ca8a86c23702a3a82876d50460bf9de6128608ef872d70ece4e44cf15bf0a26846e023ee6be0ac469
- SSDEEP 384:2JK+pOC5znumyGZlWu1uZf77ityu8WCH:2Vp5x/o57W/CH
- TLSH
  T1FC828E83F0068550CDB95E39AC6019C247A37E46FE96522B3089BF78B1F36E5DC28396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  sounds/classy(default)/activateSound.wav
- Size 18KB
- SHA256 f5ea576e9aaf2e5d5d46425026ec79ccc6fe88d00b6cecdb656ef2eb2deceba0
- MD5 a6521e11a2b0251f81c4e3b67ebecc88
- SHA1 c2fd3d6a18b9b0c3dfbe639418b88ac21e9859a8
- SHA512 3b0bdc1e082e6dc52eeabd33fda7cdffafac964c7a26d99ca8a86c23702a3a82876d50460bf9de6128608ef872d70ece4e44cf15bf0a26846e023ee6be0ac469
- SSDEEP 384:2JK+pOC5znumyGZlWu1uZf77ityu8WCH:2Vp5x/o57W/CH
- TLSH
  T1FC828E83F0068550CDB95E39AC6019C247A37E46FE96522B3089BF78B1F36E5DC28396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  sounds/classy(default)/deactivateSound.wav
- Size 36KB
- SHA256 61a34a0a134cdcea564df53ed05dd648bcd8968a9e5bc7da4e39584b5dd0421a
- MD5 264fbfc731f14ec271e344867e7c2a97
- SHA1 e5e6104e86076d2a8de511728bd09eca90f5497c
- SHA512 bbf1e11afbe2617563e85094fef24df8c868d32e1f20ab735d0d26c73d9421e35fb5897d43568bd2b3839931e3054f389475feb6a9637d419b0af303a0fb5f59
- SSDEEP 768:uAfFkcflKkSOmox8XijEpQSsHJB7T5GboaRJSwvj+J:rdxlKfoxMijDSwB7NGvR/+
- TLSH
  T1EFF29EA7F4479923CC661D35CD32BE9106B23C16FF6E612F3044790967F3782E62AA91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  sounds/classy(default)/udpSound.wav
- Size 128KB
- SHA256 08fcd8a267d1242cee32a7ca82c7aae5d767b65e62f57b9f0e3aadafafa58f87
- MD5 29f81ef90b56d94766d25700402a731d
- SHA1 ee3b0b941234b76d1cc9674a84458a50c6b4d384
- SHA512 8e6d18616d30cb4a5bc1a66ad70e161575c212e9de1cd0a513b6f54a82797fb122f693d74d3fbf5e7bba9ea501560c04d4b23ebdfdf80bc67b553a596de40671
- SSDEEP 1536:MZzXV1Yg3JNao3VItpYRW+2zZW/CC4dpBWFOWo6AuNHuy4tf2c89WCV8u0By8eBK:mVmMfaCotC4dpBXy9IV8kw008At
- TLSH
  T1F2D3B482F340DA51C4466A3A8A56DBF91336BD55EF0BA7233064FF2B7CB20C24E656C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  sounds/deactivateSound.wav
- Size 36KB
- SHA256 61a34a0a134cdcea564df53ed05dd648bcd8968a9e5bc7da4e39584b5dd0421a
- MD5 264fbfc731f14ec271e344867e7c2a97
- SHA1 e5e6104e86076d2a8de511728bd09eca90f5497c
- SHA512 bbf1e11afbe2617563e85094fef24df8c868d32e1f20ab735d0d26c73d9421e35fb5897d43568bd2b3839931e3054f389475feb6a9637d419b0af303a0fb5f59
- SSDEEP 768:uAfFkcflKkSOmox8XijEpQSsHJB7T5GboaRJSwvj+J:rdxlKfoxMijDSwB7NGvR/+
- TLSH
  T1EFF29EA7F4479923CC661D35CD32BE9106B23C16FF6E612F3044790967F3782E62AA91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  sounds/funnyWav/activateSound.wav
- Size 5KB
- SHA256 18aa2e7b40e02218a50b8199da770c5ec1dd2a7de08b3000dd49fdbd54a4666a
- MD5 f9e1c67c46dac3945eb92e951f8b2d76
- SHA1 e5ef1e9f07f3a54edb65036583342f0bcd58adb6
- SHA512 8a2b214d9eba97d0ad50718a30fbcbb484e7bc6d7da4061661793bb3800d226eb97286219f38360c8583a066f131246d95ed4cfcf31f3486565c6bd45b26b77e
- SSDEEP 96:urUOHtwNPVH+akAtB+lCUWQEXtpmCPBINfZoh2RH0Vj0FYCrOZriyWyP7dfCW+jz:urbtwNPVeaJgEdVd9PBIRZgIOCqNzP7i
- TLSH
  T1AFC16BA7A377B47A6E00C7A9DCBCCD6C7C42207D90845BB9140BDD728497A32DADA784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  sounds/funnyWav/deactivateSound.wav
- Size 23KB
- SHA256 38e19e9107f33a83f7bde991f41897a5df6d3aff59baae033c99713ea946163d
- MD5 2d3d6b92b0c64daf589194654781aff4
- SHA1 a4ffe9152963cdaac70c28e37dcd5428b1d325ed
- SHA512 503ee0aae6ba8283497fcc143bc246db636152c115b3c8efcdbbfa83ffd229c5fef77898c0d431a7b9b0c94cfd130b781afebe8d94e675d03f6ddbae93d3ad64
- SSDEEP 192:74ZS3jo00zbyRv0E3MPRt0DvVc1nCzVod63bN0QLxpwvp/SHvJe5ydZL5EpRxWgc:7FJX3MJt4VanCzZzxqvNuY5O9EMgKOc
- TLSH
  T159B238ABA0C1BC456A4B4779FF2F8A5EB6ACB9D1CFCD43510118EDA340B5071C59AF82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29
- Target
  sounds/funnyWav/udpSound.wav
- Size 14KB
- SHA256 9c25ecf9ddf8d29e1fb4a1ebde65699dbebe1dbd57a2bbd1863b9c2ead78d700
- MD5 528c7f640ef0866a0ca13160aa1faa51
- SHA1 9a129a782536c56db029a0eaaf49e978eec8b9dc
- SHA512 e8ec9c5dadea680fc8490dc170381b04f1b941ae7dadaf99620a59b434ab979313463f958aa31c5ab622a22303b1fe5c1e94e1dff379441d9acaa3aca6df3656
- SSDEEP 192:+ieer582c/sDLf7yI4feCQYC9VxaapMja6XNyef72TbVoeMv9fklgv2Sj/IH:+ROc/COVfeCQzVxao8pXNq9Mvyg7/IH
- TLSH
  T1BF62D45782D23D081A0B8B71FF5F11DC730DF6819E6EABB81516DE6600B50B1D5B7B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  sounds/original/activateSound.wav
- Size 945KB
- SHA256 1d09325b935e7e31f20479735bdc309b5d4ca82c060b612197c9ede39a010602
- MD5 92d1bcd18a6a0d088a891d6646b6c5cf
- SHA1 01a60d5e11f8889c4ebed31360a26beb98f05d6a
- SHA512 0d17bdb46f28c842aae36718dba1c3f4d56fec22c8f8d81cdb376bffaee7b5a322169a817807a0635cfdb889a4c1fc9dcc322978e2f50e8f61b19763dfd33c0e
- SSDEEP 24576:gxJ6S4b4nu2P8WimOF4B5XtJRUgZRNi3:UJ6zbrSpimO6J8wM
- TLSH
  T10625F128D9737D8EDB9308B1F653EB38930600B7C4128FA9B924DA1E755FB4139B8647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32