0b8cec7a8c63b4de54da94a3f33e8658045f1bd7acdd900e4fcca69a21a0b77b

Sharing

Copy URL Twitter E-mail

General

Target
Roblox7-Revive.zip
Size 911KB
Sample260823-1twwha1bme
SHA256 0b8cec7a8c63b4de54da94a3f33e8658045f1bd7acdd900e4fcca69a21a0b77b
MD5 558eb8abd59bfdaab18b07e7d935eb23
SHA1 b28a079f9bf89a8655357361e73eb09cc94e2d56
SHA512 da15aac0350ef9c503a425b33dbb2e0164eb6445113b7d789fbb1cc4fc9339aac9b490c5d39af80f6b054dca6f3f59124e79769c8c75c0962750b7002a6c1d25
SSDEEP 24576:3xth/kCEMW1X9877Xxp0VxTTBrkKMQdZiBQge:3/hMCEv8/xp2B7MQH
TLSH
T18215F1B9CEAD0468E886AB3428847207B789D70795E75121FB9430F56E890D7370BFDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Roblox7-Revive/build_and_package.bat
- Size 7KB
- SHA256 342495041e65a9eb024c9d3132bcdd857fbd7ec28d8355756a791140189997d3
- MD5 38dbd63a8326da9d330988c33b5995dc
- SHA1 b0e94f085ee96a874ce674dffc79cbeda8251970
- SHA512 5fd66ad22960c7d569830e96c6c7f91ed2fbddf3a5ab759c862765728570b65b4798234a62e50a7aaae55e054f4f02df97921c98816873da6406147e89010231
- SSDEEP 96:KeLjrtuuWUPEE7oozvGFu6Seu6STujeujZDSDnfSfZuteutquReuRuJup+qrTQWR:KenrtuDoROFvzvc92RDr5Je+q/JRBh
- TLSH
  T102F173AA2C5E04965019C2BD6C841581FB09C5A7066FDEED710C256E2F2E7C4EBFDEC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence spyware trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Roblox7-Revive/build_and_package.ps1
- Size 238B
- SHA256 336c056733f5f6c0031e96b33e53b17c0553a02f22381f8f6759ec9e3f03cf17
- MD5 f14c03e594d4f3bfd3bba72e635d2af7
- SHA1 9cb5c70c5671feb3c5e7073315e6e1ed3e687d79
- SHA512 4e49f222f5f0c50c59c0d08837c9942099a12a5564cd3035deb573adb4e360a36906c84264e303466fc4c75be43262d2e538310da7cbc3d427280cbd8f3c57fe
- TLSH
  T107D02BB841102224094E84290CA60ECA483EA0FAD2799BC87215240D3113964D39724A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  Roblox7-Revive/deps/luau-0.640/Ast/src/Parser.cpp
- Size 106KB
- SHA256 6f01d13433071cad36e975a07e646ced9b9c242a200ccfd027dcfccb969d6ddb
- MD5 5476e544b281ca9f489a5a12f587909a
- SHA1 12fc66da6c8039c338825fc6b89866630405eeda
- SHA512 75777955cb03ab1b4038eac7b36db53551336df76464b93f2e175228907424639184dc1dd83440c4e50d35e3156fec954155a58d4a5b0b9af10b37a0f9404725
- SSDEEP 3072:duarmhxnXltmVgeOPqHRH+Ubu51dkaHOBcC9i1NiYEFbD+M5e8dvteieVoV+Tuy:duarmbXlt5yDj5XdC
- TLSH
  T134B3559A34A10132D6E7627FCF5F9919B237504B710CCA90B80E51E02F8596D9BB3BF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Roblox7-Revive/deps/luau-0.640/Common/include/Luau/DenseHash.h
- Size 15KB
- SHA256 3caaa84c26fad72259fbbf8a234dd36eaf9ba71d4e4b5143dfd9cf85277ae95e
- MD5 aef80995d4c884a9919bdef6391459f0
- SHA1 3e993ba5bc6eda4ac4bffc30e120165ef4c74e0f
- SHA512 f4bd4ccdab8bee3c976b2d013648daebe860ee7c05bd3ef2e595ceefe85e2e0cbac1181528d2a2206768dced4b00ec66d697ae8c05b6b2ea0bd60f884fe085b3
- SSDEEP 384:0naZ/3aC2VY/4OPDJKbP/IwPgGCKiYN4Ab6:PL2VIPDJiPUHYm
- TLSH
  T16B620D8520E376009367F2F497D78411F955A043B24DCD987A8E4160EFA30B8EBBD7BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4
- Target
  Roblox7-Revive/deps/luau-0.640/VM/src/lbaselib.cpp
- Size 12KB
- SHA256 3789016d82c1b3e41dacb516c7c3bb7518e820faba121707cd24ab18582071f0
- MD5 722353eb2c6ecd21b20c5a09d931d69e
- SHA1 d37e364e4ab060e13a6832c41c61c194c1df2886
- SHA512 4899f69fec8b3ca5bfbe2be6dacae753eec25c87f953b667a02c5961af6c8c852528d215f5744b3e378829f02862d9757b8ccd0637dbb20e863f81fdd9994374
- SSDEEP 192:djBZ8hjKw/abi7qqayiQWkHfXsPwoWhwWRFAM+2KWkokWbV+WfqyWbqYUGQWaWMu:djQd+yHk0CUzeJT9StBMX
- TLSH
  T1D042300FF18270964963E52C47AFC6A19A58ACC303CCD540B65D4D527F6A0BDE3BE6C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5
- Target
  Roblox7-Revive/deps/luau-0.640/VM/src/ldo.cpp
- Size 16KB
- SHA256 01119750a56250c089d31ae4cd47848028e32050f1a488cb0670c44ce7633409
- MD5 f59235923dbe5eac2cdcbb1846152b1c
- SHA1 c2108400d38d05324df0b9b7172d2d7aea1ccbec
- SHA512 3617af4b0114aadfa274476c2ee7dbbfd5785025ae6f4b1760d5b047196cb100dc6dcf239d37aeea1ebf0e7792c0c39147269b6a4c9fd65b4533488782adfd42
- SSDEEP 384:QaVNfl0bOOOhO/46J+abfpq1WGedk1uMN2XO:l2bOOOhO/5Fc0dQuMN4O
- TLSH
  T13C72960E48A210518A52133857CBD3F8DE79C9D7622AC5D0B88DC2447F5427AE66EBF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  Roblox7-Revive/runtime/scripting/LuauEngine.cpp
- Size 21KB
- SHA256 150ae347fa1cb36cbb57b3e44176df8fd86ee433bd55d1182e377c42d9019f6c
- MD5 3473ab5f0c8da86cca1f7c414d5b9cea
- SHA1 55787742cf2ee630275075685a2b916f6715c0c1
- SHA512 5f73e612621d92f55cdc9dbed94733b87202a1263bd8b57b0de9fcd9562697c147326a6713bc594cf18bb0ffc44fb767ea799facb16718703e552ce28d5df967
- SSDEEP 192:TGSnboZVYWdiR1r6FWBQWfHMz1AWdmMkW75HMgM2Wjp6Ch6c626q6a6R6WoMVMfc:Tbbu1RGyTybHty
- TLSH
  T16FA2209EE1E3F5021923607C0FAE9549A656885343ACDE22F94F0C00BF6503DDAFD79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Roblox7-Revive/third_party/luau/Common/include/Luau/DenseHash.h
- Size 15KB
- SHA256 3d6dcb4295d7adaef4c409564ffa4036f75e4fca9353786cf1865e8924c6fc65
- MD5 9cff72b0cf62701eb487136d15062154
- SHA1 1b717f65032c8015c03a3374f1b98817a78d7269
- SHA512 411c4ac5abaafc8248ca5664787ebed1ccc2e2a6e9c64810a848cc7583a1ad469f392158b9d82aefcb1af01622ae97e9ee237c3beb01ae49af1cef2b40a5a728
- SSDEEP 384:h/3aC2VY/L4PDJKbP/FmPgGCKiYN4o45b6:NL2Vu4PDJUmPUHYV
- TLSH
  T17872108520E376009767F2F497D78411F956A043724DCD987A8E4160EF930B8EBBD7BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral8
- Target
  Roblox7-Revive/third_party/luau/Common/include/Luau/DenseHash2.h
- Size 26KB
- SHA256 16ba3239f4c9d0cee645aee1e19b51ff2d17a16d22a0093cdec8bc063f46371b
- MD5 ecfa744504d1d2ab6e90622a8174dd9f
- SHA1 579386adc621e4cdbc4c28c05286d811cc64cc7c
- SHA512 fff54c93cd8ebd539431728da1ea8777499faf5baf040ac1ee4a7878aaf797af6fdef4fe0c74b4b43564acc8c8f3b7f71e7c05e7fd39c5c880899902288577b7
- SSDEEP 768:ThBx13LEnj2AYwncplOlJTkXm9Qx4/Y8J3YsHYC:T/x17Enj2AYwncplOlJTkXm9Qx6JFHYC
- TLSH
  T154C2B58621D736209767E2F58B8BD412FA11A013721DCD947A8E4220FF53874EBBA7F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral9