General
- Target MultipleRobloxInstances-V2.2 (1).7z
- Size 607KB
- Sample260822-py6eysyyhv
- SHA256 3a8b9046245b5a09adba04042972a06e85c39f1a4d209dd51a6ec6f9838d4aee
Malware Config
Targets
-
- Target MultipleRobloxInstances-V2.2 (1).7z
- Size 607KB
- SHA256 3a8b9046245b5a09adba04042972a06e85c39f1a4d209dd51a6ec6f9838d4aee
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MultipleRobloxInstances.deps.json
- Size 2KB
- SHA256 996b2e102bf4960655030405fac9b3c014cf22d7c3b1072c8fd32161c0d80d39
Score3/10 -
- Target MultipleRobloxInstances.dll
- Size 501KB
- SHA256 05cb0d51733c227b7bd084812a2aeab38cb767047c833f56a141859bebab3222
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target costura.dll
- Size 5KB
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target costura.pdb
- Size 7KB
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target newtonsoft.json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
Score1/10 -
- Target system.codedom.dll
- Size 179KB
- SHA256 763c881ee2b87c7254d6f61c303b5de3b59282fcf1448eab7c797bff4e0ea989
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target system.management.dll
- Size 71KB
- SHA256 45bddc7a2aefc98d8d7c5a54b9066230cc21b39c5722af1f05e9fabc54b376e2
Score1/10 -
- Target MultipleRobloxInstances.exe
- Size 155KB
- SHA256 165afe5ab199c8fcc158eae432d51747024d16c936a8f5bfe2e6e5a9b3146bf4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MultipleRobloxInstances.pdb
- Size 28KB
- SHA256 b839b345b55f9f34002eaee611ee3b467fa94aee3d13f9f05c00b888e10a862b
Score3/10 -
- Target MultipleRobloxInstances.runtimeconfig.json
- Size 357B
- SHA256 a6a31e881a564ce497254b0cc044c32ade3cf5f02c6501e43c8425e8698b2c00
Score3/10 -
- Target runtimes/win/lib/net8.0/System.Management.dll
- Size 305KB
- SHA256 67f0621fcd09e8a65e4b2b95f94fd99aaece6cbad16b42fce0b2e6197ba98ae8
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.