3789016d82c1b3e41dacb516c7c3bb7518e820faba121707cd24ab18582071f0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/08/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox7-Revive/deps/luau-0.640/VM/src/lbaselib.vbs
Size 12KB
Sample260823-1twwha1bme
SHA256 3789016d82c1b3e41dacb516c7c3bb7518e820faba121707cd24ab18582071f0
MD5 722353eb2c6ecd21b20c5a09d931d69e
SHA1 d37e364e4ab060e13a6832c41c61c194c1df2886
SHA512 4899f69fec8b3ca5bfbe2be6dacae753eec25c87f953b667a02c5961af6c8c852528d215f5744b3e378829f02862d9757b8ccd0637dbb20e863f81fdd9994374
SSDEEP 192:djBZ8hjKw/abi7qqayiQWkHfXsPwoWhwWRFAM+2KWkokWbV+WfqyWbqYUGQWaWMu:djQd+yHk0CUzeJT9StBMX
TLSH
T1D042300FF18270964963E52C47AFC6A19A58ACC303CCD540B65D4D527F6A0BDE3BE6C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4772	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Roblox7-Revive\deps\luau-0.640\VM\src\lbaselib.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads