49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac

Sharing

Copy URL Twitter E-mail

General

Target
Roblox.Account.Manager.3.7.2.zip
Size 4.2MB
Sample260729-txem3abm8v
SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
MD5 d58b79cb3d3635ba963427362f75d075
SHA1 0e33eeff9b625fceb2d2d0195e6f32523d57db79
SHA512 176de76618d0dc43f17e2971787666b737d7308a67f40bd2bb82ab4f0d3276f877fbeb7cc987f797e6572ec736c29d8568f441194a45cb5ba8d751bf139ab79a
SSDEEP 98304:gYRAasq6wh5OiduKi0yAlWNYrsmekq13pgOtleGlci1D7VaMV:7y5haDbyAMNY4mekmCOtQi1laa
TLSH
T199163355FFF3828EC2A1A1755041ED3AFB994ACABB30DDED4A60E7E29C08D511C0679C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Roblox.Account.Manager.3.7.2.zip
- Size 4.2MB
- SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
- MD5 d58b79cb3d3635ba963427362f75d075
- SHA1 0e33eeff9b625fceb2d2d0195e6f32523d57db79
- SHA512 176de76618d0dc43f17e2971787666b737d7308a67f40bd2bb82ab4f0d3276f877fbeb7cc987f797e6572ec736c29d8568f441194a45cb5ba8d751bf139ab79a
- SSDEEP 98304:gYRAasq6wh5OiduKi0yAlWNYrsmekq13pgOtleGlci1D7VaMV:7y5haDbyAMNY4mekmCOtQi1laa
- TLSH
  T199163355FFF3828EC2A1A1755041ED3AFB994ACABB30DDED4A60E7E29C08D511C0679C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Roblox Account Manager.exe
- Size 5.4MB
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
- MD5 334728f32a1144c893fdffc579a7709b
- SHA1 97d2eb634d45841c1453749acb911ce1303196c0
- SHA512 5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f
- SSDEEP 98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE
- TLSH
  T12246E02A72A04335E5AB45344468C1B496FE7E3A6A68E29EE7C0BD5F3DF5BD09430313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  cefsharp.core.dll
- Size 920KB
- SHA256 cec6e0403a2dafea012ee965921f44657caec0f07e813b8f7d259d90351cb8b0
- MD5 87fcedd1e06c3c6e5985616320f6e7df
- SHA1 c5a4fd2931f39fcdcff0366a260ae131e688e98c
- SHA512 9c0c4c975bc5be752b0fe757275337d089534d96f335ca7ab194a2cc366968a93dd210bd297f2f40ae8d4753026a21110173f48f8e87a8197d6fd323169bcdd5
- SSDEEP 12288:AJYiopTEAzPl8OI9WDgVJpJJpJXX5PFE3yeDZ:ViIhgRhWieDZ
- TLSH
  T16B15F91577A89B2DE79A16B3E1314FB60673E3063656E3AD7768A6AC3F033005D005BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  cefsharp.core.pdb
- Size 2.4MB
- SHA256 bae3a6bc284b88446cc09af3b1975ac6a5fc87b83164235476e4d82279bfbfa7
- MD5 ba6ccebd8e72209752747aa329aae725
- SHA1 cf36e78cdcf8a2c9b882791dc0a15a3eab2da189
- SHA512 08e4a08f449fd5bc1eeeb318160dcf9c2f79c370cd85820bb2f30d07c19c5b7bfd7c127023344f379e115065796cdf141d42da43769bd6088a1c5b5deebcdced
- SSDEEP 12288:0mc1Tn+xlBmO6dJWQI6Jl7eIEvCBBUmMMeE+aSFv1I6JlZE+aSFrh:0mch+dmO6dsyEv1mMZP
- TLSH
  T127C58127FB40CE73D469893C69AEDB0D0739F658AB42D76FA945B13C2E853850D0B2D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  cefsharp.dll
- Size 273KB
- SHA256 3aca7c62000daa613e40714c0c4b7a8f99b9f392dc59adf66334be76f892028e
- MD5 446717551db95d0630c652d196a8e8ca
- SHA1 7a3d52f42822b9948db1fb7e408b5ee6867b4940
- SHA512 4636c97d6e0ab7da9eb0dacc75fc9ab9fa5ed300bde31f72033d4bad44b453168c30d87a35bdcb39c9e096f6b66e198a798fa0dc97c6738092c742f0c8e447a0
- SSDEEP 3072:I79yn4kb88X+7jbc16LMfqtgvzyWajH+cO2bm5kPExVX0TOKTAQtrz+pyUU2+tKn:fbtobyRfYg2tz+4AeMX0TjTAU+pmBK
- TLSH
  T184543C0577E8AA25EAFE4B39B8B02D0A0FBBFD19B035F79E4D08552D1663B058940773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  cefsharp.pdb
- Size 1.0MB
- SHA256 c28dc55559a712ac69b7c3c7bb3b3189f7f23b05382d36e24524d7396ada2f9f
- MD5 e5d1a852ced2f28bbd643655a9201b41
- SHA1 a64ea6195ca570f73ef3af03f81880cab50425e2
- SHA512 bb6047ae6a34704eb41952bcbb0995435d1f88bafa11c531cdd485ad450f9c4bd4d4e346806bcf47f2f59893c846f8893c453940f293df3cc6dca53bac64bdd0
- SSDEEP 6144:IPxZWhj4WZZxQ4q5Ak8n2AcpipXC5Gl6RsdXjc8exhi8HZWhj47ipXC5GHc8exJ8:RjLTwAk8hpjIs1jVjPjH
- TLSH
  T16D35611BFB04CA33F1F8567815DBAB0D6377E3546243A7EF9248A1183EB22493D4629D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  cefsharp.winforms.dll
- Size 52KB
- SHA256 8298c55b1687b3962f1ee4565bb77dbe76f583491d9b02cff7341c1138331a3a
- MD5 2f93c2c8baa036bde6f4c4e038d7729a
- SHA1 11fc4fc936cf6ff821df1a37b2733abeeb6d36cd
- SHA512 92832721161a3a9e9f8905ba91fc64f879abe421c9095bbc23c21ce4fcf89c0fa0ace3817fe976154ae6a6b2e050a43b1d5b91527e84d6bd6192df6930972897
- SSDEEP 1536:so/AhwNZrYv1tYsQ8kmJOuUySMgYnbgL:sgNCvbYsQ8kmJOpyTgYnbgL
- TLSH
  T12133091643BC9A7BE7EE0A3D643025510B75EF037592E3A99D01B1A619FB3A0CF503A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  cefsharp.winforms.pdb
- Size 151KB
- SHA256 2468af2e71ec637d867064b6096c88da66a1478bdf59503bfca05a4f0142b3cd
- MD5 b3cfc084ff2c9f995ea2e632e90b9dcb
- SHA1 779bfb4410959e2700a3ea8edbf99f1e7cac7edb
- SHA512 906bcaee528ab572fc8ac456bb67dc2b8145dc65909e9302253d6d7e0a0839ab6ca52b6627f760af9554680c0e190f12c8ffd02bc7fc87610a53f870b4b126dc
- SSDEEP 3072:QG889uGQHwIHMSlZVOivlLVbHiUVMVbWi:p8WsHDflZV7bHiUVybWi
- TLSH
  T1B5E3B62BBB48CB33E078453419DB5F0D1336EA4266839BDFA65971186EF63093E4639C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  esendex.tokenbucket.dll
- Size 8KB
- SHA256 e46f8e5e563b16c889145f002474de6ef7c78e53ac3cc632723447e367d338d7
- MD5 e7842bdb3c2f8b557acd548ee7438434
- SHA1 056baa4753b0c482bbae1c1cf5462f92efe5f6b9
- SHA512 1410aa0c8bc2976ebc527b2c55d241a2b316c50c95e2a03d901464aac0f37d87e63003ea747ea027e5b8f45dae038d1752a4b5372f2bd069a7f856d8f402be34
- SSDEEP 96:7L4Jq/43T3BdCfbcXdKIynwlTIaDph4kdOMxhXk:f+3Bkf4YQnmkcy
- TLSH
  T131F1D81413FC4B33C9BE0B71ACFA42011734BA119C77D65F454D8A5B2966B940AE1B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  fastcoloredtextbox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH
  T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  icsharpcode.sharpziplib.dll
- Size 248KB
- SHA256 cb9c05b5a1e1db26ff43490ee26f2e02abae3f321d2dd5ddd43a68da48eab83d
- MD5 9e9e0a210297968aaf2e00d13958c0b4
- SHA1 a32d2dbeac852718f285e26e3d9436a97879e55c
- SHA512 d90deec822f12c55a77e1defba102c3ef803bb463afb43123dbd2fee24d876bb670d71db74cdf799eafcffd74c8afa19de36c3c2f2fbd2fc588e28580f344a53
- SSDEEP 6144:1XvJj49GIq1a+L0g9FWz1SSA2ltaccym865I:v49GI2a+1FWZH+cw
- TLSH
  T130444A142BFC4B0AF6EF5BB5E872819687E5B996613FE38D5C8490FE2C027918801777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  icsharpcode.sharpziplib.pdb
- Size 118KB
- SHA256 d14d75b91138cfda95c8396752c4935fbe8afdad12e026c0845899b460bf555e
- MD5 6816fa53932d4a4a32c78258f14dbec1
- SHA1 e1fca83029d1440f54fb3747b240365a6df0a598
- SHA512 fea3d9ab701356d82daf43c2c2bcc88a6b6bdf0818724678249a705ba0eaed0c80250359b38795613f6fd4137afbca1cf85585a76ade6182f4d3827653164404
- SSDEEP 1536:1RQrIuJMBnA7iPQ5hanP7gKf1PAzIDSbuX5cKMxmMrQqNJfsTlRvTHxnsv2:1qrNKnKiPQ4jgruX5qFE5v
- TLSH
  T106C3D65B92CC832FC406153DC5A29255B7B5C3BCC64B8F1263D8E635F85EB2887A3E64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  log4net.dll
- Size 264KB
- SHA256 4ffeecfa1564bcd632891c7e0f376669227ed177e4f34bd8fb25f493162d8c3a
- MD5 b1f2f30cce59ac4e12329e83c8b807b1
- SHA1 9b5b84143fe1d90006ac69d06d2fbd57c949013d
- SHA512 b8d49fa7abdf528b629787adf70e184afac1b417364b9628459014ad26899b8806e44d3e27b0bec728968eaa295d0090fdea73efa31dd699b5f3ac718842c8f7
- SSDEEP 3072:hKgY9I6srcV3x5angC8Z7ZEymUS31PQjRv6HaQ0YMkQyUSGmvJukKn7GXcE2qgj:DESngPiyePQjGkyUSbhuOcE2
- TLSH
  T1FC44175477F94A19F2FF6B74A47414558BB6F956B8BED75E0A80E8ED2C23B0089003B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  microsoft.aspnetcore.webutilities.dll
- Size 64KB
- SHA256 0f96a425e05decd3484eecc05f1957ef39768dfb1ce2e4cac9e10ac30361aa8a
- MD5 0d65948a9719aa94218b0012409c3398
- SHA1 92deee204350c7c029f59054b115cbed8ffdf1e6
- SHA512 8438ceeb545f80709594eb32219961e5d13d830ddf7c391866e7e27431fb0658be0a24653f47c8311ad451c365984ecf8ed9b88e963283e8a99b9fe5a637486a
- SSDEEP 1536:PX9wrSVM+ZPyr7gyT8vPuEq3W13uX9/H2IDOpC8WiVkxO7Bx:PnVvesHPuEqiuX9/H2IypCRVw
- TLSH
  T124533C456BEC8613D79E3BFDA671D5831B36B26E6512F78A1C8CA0DE1877BC0980035B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32