51a9a81fd2370e2e49f80080ffba074402c45f19be0565cc10a4d757b8dd755b

Analysis

max time kernel
899s
max time network
479s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remote Access Trojan [Execute for free robux].exe
Size 206KB
Sample260815-3gahvavgla
SHA256 51a9a81fd2370e2e49f80080ffba074402c45f19be0565cc10a4d757b8dd755b
MD5 9c223734bcb8a2bbcb023ed057cc84e4
SHA1 ae368dd7b2fa2f9efd3929abc7ce932532507628
SHA512 e7a788158d2ac0fc54962a88de7458e595b28b1aef530fe39db68bbab8d0770c2d603fd58b58eeea1ca7a4b661095f17ee2b58528a66855bd5b9ce05e110e28e
SSDEEP 3072:mjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOPhBuYlg:mjK4TDUqgpqWDLZ5H+xuZ04QhA7
TLSH
T1E9242A02B2A810FED1B7A37889620941F37E785507B19BCF339C85BA1F63AD19D7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4888	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4888	2420	Remote Access Trojan [Execute for free robux].exe	90

C:\Users\Admin\AppData\Local\Temp\Remote Access Trojan [Execute for free robux].exe
"C:\Users\Admin\AppData\Local\Temp\Remote Access Trojan [Execute for free robux].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Remote Access Trojan [Execute for free robux].bat"
  2⤵
  - Executes a command shell one-liner
  PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2596

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Remote Access Trojan [Execute for free robux].bat

Path C:\Users\Admin\AppData\Local\Temp\Remote Access Trojan [Execute for free robux].bat
Size 64KB
SHA256 d78d734309d63bab5533859f5a93984894ad0241926124750db50d1efb88f69b
MD5 2cfb9d867a6dc54371aebc8abcb7e04a
SHA1 91bb91ca7e6932b811e64a141b81ca3db1f10275
SHA512 4c1bdd08e7332b6b33878a8b13fe1f43c55d187be4fcc61a5077b50d4499ad3a249341bbd092bf64b6a8eaa67cb11df031108b40bacefc892c4ceb18341fc27b
SSDEEP 12:Y9zIyX33KoR0rFSYfM2DcVjzZON9eq2ias3UCkS21lNeUWA4+MsEh+GgWA95LKKT:YFXErkYEJ/4Hb5t7LA97Xt7t05n8X
TLSH
T17253ED75EC09659BE02265CA6E714ED5685C30E340F3DE383CEF62F61700ADB29696C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download