22995ad206457639019f700d88252457da7bcf33342a6774bbe6400e41604349

Sharing

Copy URL Twitter E-mail

General

Target
Multi Roblox.zip
Size 565KB
Sample260910-y2c29axzaw
SHA256 22995ad206457639019f700d88252457da7bcf33342a6774bbe6400e41604349
MD5 78041a1dc10274546392672448abd39f
SHA1 c843b6cb8aa171a71a4a0f33ed9378193c8874b5
SHA512 f5aaacf53d05dec5b4b61337bafdc16b198af5216052533d092601bcd2fdfd24036eb1c74693cec4b1efac0804627f998c6e7f9a3cc6a8f20b139d6c7c299f2f
SSDEEP 12288:V/YIEH3LwUhTyr/Rifu7PVQj5aAVXLHHJvVUFac+Jf:l8kE+r/RyeVQj5JXLHHJtk+Z
TLSH
T14AC42310A00AE05CE8BAC0BCE4F67ADFB8D84E24724DB27753D426B675950D1F9E8B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Multi Roblox.zip
- Size 565KB
- SHA256 22995ad206457639019f700d88252457da7bcf33342a6774bbe6400e41604349
- MD5 78041a1dc10274546392672448abd39f
- SHA1 c843b6cb8aa171a71a4a0f33ed9378193c8874b5
- SHA512 f5aaacf53d05dec5b4b61337bafdc16b198af5216052533d092601bcd2fdfd24036eb1c74693cec4b1efac0804627f998c6e7f9a3cc6a8f20b139d6c7c299f2f
- SSDEEP 12288:V/YIEH3LwUhTyr/Rifu7PVQj5aAVXLHHJvVUFac+Jf:l8kE+r/RyeVQj5JXLHHJtk+Z
- TLSH
  T14AC42310A00AE05CE8BAC0BCE4F67ADFB8D84E24724DB27753D426B675950D1F9E8B4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  PACKED.txt
- Size 140B
- SHA256 2a9ca76adb5c675f04e29eabf2c45419ed342a3749f1d01e2dbe0840d0fbe7e0
- MD5 9791f64d7b1a8ea440420e5088647851
- SHA1 7201b4d0ee9ed104fd5b96ad0b37cba5d4d09282
- SHA512 1d36f6b68d2c365fe8e9e3eb1b8b2776c934b195c43be2d3acba91a2c6981c88ca08fa19a930d7e6edf9e7f3744203ba5cce2b2e11a804952a1df9e07ae879cf
- TLSH
  T1FCC02B358FCD9D103403018BCC2B0001EF2C700511E7B480D351BB7C1B4813C9644440
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  assets/rbxlabs-mark.svg
- Size 1KB
- SHA256 e9a08ecb4b1981797a7c54baac1309f5418a0b1cf9c831de31ff5a0d0966e8cd
- MD5 3ca083821122cea20d0f7f98dd3ccda6
- SHA1 a628561bad6e400e7d047ed493b2b67727722a0b
- SHA512 c64dd71461fab65c81a18f73f8ff830dd64e524bd9e1a0f9991760549794afe7dad7fbe10aef267341c69cb8a2143df7cf2d3abfd316174e541223e7c3766458
- TLSH
  T1BE115935D298942BCA2C930DC704E4643213B1C29F591200F5887F6E5F2B4D75E7B7AC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  background.js
- Size 17KB
- SHA256 0b5ebaad262c27ece31c90fbbad195645aec3bf2bd561f29fb2a6a73bb2c0089
- MD5 84654687702924b607f84b6289e1fd4f
- SHA1 29f75e1fb2d794617eafc56d6bb91a11a37cd9d0
- SHA512 500653878a9a7c299235db62cabe368a2dad9b99f05e49079f8a99511be04e329f7814620d77fdba370eb6321e8a86c56b261f0f03e032785229cf8e249f3efa
- SSDEEP 384:85Mcmw5Ov+LQHUdKdYRqoFd5005vHpTxm5JZSWtfmCrHHS+iEwY/SAFgZ+F2r0Fb:NuUl0a53HSAwTEjdl3F
- TLSH
  T1EE82CC7E30BA2025651390BD8D5F90267211F013798DE8A8FB5CA1206FCCA694DF7BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  icon128.png
- Size 5KB
- SHA256 765b0dcc35fc7d66df18212779770557fdcc0d69a2fe32f0d8ef558cc11d30a6
- MD5 51a18395fe9328878f2e9ede12479b0c
- SHA1 8a2d70516039b83b0d42ced331553ff38e9389db
- SHA512 09b9ac35efa049eacb86f3dca54b28e7bec0d135fb98ecc3c484922aebb0e2ce5b4727134eba0be4d5128443e86e69b8052b7a964b1785544c052abbbf9611a3
- SSDEEP 96:FvDVSyv+V+aCSQCu623r8dMeGaooeotTLlTyhwswWjORAGwy3UoG:Z8xV+a0Cd88KPWxTNsNjOuGix
- TLSH
  T1ACB18DF323187E19DA47A6FBF415A4142392C57B109C63C6627E09651A823A7AAC2ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  icon16.png
- Size 408B
- SHA256 37b66571b71c0f7af35219b8ff7ec21dab1198093e9c0cb807856613e804594b
- MD5 7657080211969dcff06b947095ce1d01
- SHA1 a72bccc345ceae179b06a25008cc9d038529644c
- SHA512 3b1682a51f17719f681a08e00a09ce819765471c0e6d08bfefa6056376b2a7215d156e922e026c2bd3f49a5473db1014c40fb1bb47f9a03ba98b0c0de8c87050
- TLSH
  T1DCE0ABD7338778246C829F29236AD558686D765E8A45D4495785CC7F2E8805AA8C0E06
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery persistence
behavioral11 behavioral12
- Target
  icon32.png
- Size 664B
- SHA256 3a2f6fff76eb0b2c7929e402da0c5c54753275ff36a8ac1dd308e76d961457e6
- MD5 057d1dfe23371056291052610c8d986e
- SHA1 b6eab04892b6b981fe6e46703584d81d8382daf3
- SHA512 942a4c4599c88a8bb1334c166915bf950153d3f5afe6f448885727d5868c7c6072c4ae52a39337ba52520707bd8b49af82bc621f660e0f6843b75304f6eb8f3a
- TLSH
  T1BA0183F2C2A49EFCC2196914712390EEB8430FB66B770C003B235D26006B87ACFD21C5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  icon48.png
- Size 485B
- SHA256 acae095ffdad98f0014f6c8499e0b8b1dbfa08e9e3fb99cc189ba5f3a5c42056
- MD5 28534336844456d0be17807d138615fa
- SHA1 3e10fc56641b7aa522374e83c5fad62bf3e1a211
- SHA512 b2597f8fd7b1bd2f42bb6c30a8b3326028c227aa3ebdcaa8d2be94e7821663e7362218b2a04d832253466209dd81b413624bef68088f2c0886b87f200cca4a2c
- TLSH
  T1A2F0543304610414F677ECA3ED5670D3E6A687460A2E40E9A0B65AD00E57C433382727
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  lib/shared-core.js
- Size 127KB
- SHA256 8c66cbe5607708ee427d88cacd732daa12dd8226720f10289322f3db2733b64a
- MD5 fcb89a93a830350db8ccc0a7d8153443
- SHA1 b5d40f49baa259db73d6b564dd615be28d261e76
- SHA512 9c1cc44865101002322254e8970120bf28e0faf76bf0fa040a962827bb58ebc345467224932a74e93d789ffc6d7e9374c1ade332173cf4f7c1f9534aefb8ad0f
- SSDEEP 1536:5DFVrPO3i2kb47Q7QLBXxzUlkXCib/40EaCvGQV+n1ki/ZQZDUikOtWsBKBKdmzw:FrGybjqHz0vPA2kwU4JV
- TLSH
  T126D3A9BA14B720250A62607DA78F6005B2369013BC8CFDD87E9C87249FC9D3965F6FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  lib/shared-sw.js
- Size 25KB
- SHA256 ca528ccbe0b6c248cf67707476ea3582729a113e1712159b9e8f54a1023dbcbf
- MD5 a43dc344d9d63f726bef04243990f95f
- SHA1 fe1abac390a306cdd24d1335622638db2e0828b0
- SHA512 8624ebf8cf15c36e2f6ef135caa5cb4e621981ea48a8ad3a400b72bedb347d4d56c2e4c3e7761cf384bc483a41522a125bf9875babc8aefa230245c38a8d5280
- SSDEEP 384:+aSwS+i6v1Um5NGR+08RuFq9M9Sm3GFV9I2jW:+aJ46v1UWGR+FRuFq+Sm3G/WiW
- TLSH
  T15BC25E9D2DFB2035656330BD4B3F9004B2A2C427059DED94FD6DA4206F58A7D0ABAFC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  manifest.json
- Size 6KB
- SHA256 7a4d57cf966c54c2670570cb4d8fa83f82e00f0c5893ea4f004695e1cfe31fc7
- MD5 0f756e1d3af50f013255b14f1eccd119
- SHA1 a1a6b2e5ce9c73022117420b5434d8714fc3df3a
- SHA512 3c9033301a03abb0b4e7d085ca91e8615abb88fb17a79fec7fb701c9f7b81d956b9fb405257c3e547e0df3e8a567832ce7328447f298ec239c5c77a0c93a1bd7
- SSDEEP 96:/PuJ5Sz6fy4u5gsHPsjsqsssPiXYFjzFo50QjoVDorb4H5do7HC8vtsh1g:UwX4uyZ00UdH5O7HC8vt
- TLSH
  T1DCD1B6EBC704981A2B248996E065720DF607415F7CDABD8AF350843E1F8CDEF6879268
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  popup.html
- Size 6KB
- SHA256 b92d0d431dbbd9117b145bca27bc623009e425bd4bebbb015ad0c82e94522dd9
- MD5 6e41b1536d6a706537d6bd98b4a106d2
- SHA1 f812dbd35968edd3c06a66d01c45d81190a863a2
- SHA512 db0360445d4266f5f6417a5266ee1ff4b909ed37f1a3401a1231107de5eb29a4ae9ac181ac0b83deb8472685b48c0b46cba122f4dc89044504e4ae4c68c24500
- SSDEEP 96:fvT0bTDXPEk1akfizmHmVPmNmxmnwVhAek1hi9lao/lwa3WyhdaueuNkmnf1RbP6:fvYbTDHHfiCGVeswaKekHw/ZNDn/O
- TLSH
  T17CE1EF20A4F55973626741C8F5956B6B3981E643CA8B2148F7FD0BE20FDBC84EC0B06A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  profile.json
- Size 164B
- SHA256 2b0f9358fdfbac5ac37112be77ade93a82b437b2069765451fe8ee3d7282f95b
- MD5 fc31e99ab83274ec47492ad7fcce3894
- SHA1 af3958e876151042e4c8b4692f6ac04cfd0e3ade
- SHA512 0fa7bb3face0f2136b832c0732f2a72b0f1154ce115bb16ca3ca07fc654860ef6a72d5c9e424a872bed14d25419f4374630dcc9d517d4409f3b316206ad056d4
- TLSH
  T14AC022338E852C3824038AD2803C2384889F000E48E04148CC28E80A08DF9028006323
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  scripts/accounts-manager.js
- Size 1.4MB
- SHA256 5022b50c9179294b210d6ff525051f7692f78860ae6dbdb4c308a9db11f3efe6
- MD5 079e04b8b3347d4faa65aac9809480c1
- SHA1 46aade43e3945c5faf286c7dd453b48215eec15f
- SHA512 4a52cc15ae6ab2fb73beabaf4760b0fdfbf6554a7774aa06ac33e1c640aa38e21e35561afeb943efbfcd8f3dc10bf806b22a546aaed3ed9d508fd80bcc5c3bb9
- SSDEEP 24576:hSLoLmLYFtfT20cCzsk2N/QhQLITNAud4nVTQ6jZmktBGGsV:hSL5QvcCYWh4nVTbjZmktBGGsV
- TLSH
  T13F65935063C17CD112475FB6771FB2E5EA2E4ABD3188088BF109BD50FBB9906EAE0971
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  styles/accounts.css
- Size 16KB
- SHA256 08673da583e214e706557e48be42d3f545250e52049fa9175aad3063cb2d5554
- MD5 baba11bc8a0c6b026c77d24fa1c64110
- SHA1 0d10e2453a0eeb43a6f7a3f162f862ad96d78569
- SHA512 c5cd1c6b3ee7ea89ac0278bfff95ba647321032577fb19b0ab673a7b0b53fafc3e35105fcdc0d79ffa79e3e4e2fee7c1f545b58cca20554e7653ccb57e32f964
- SSDEEP 384:k5yF6dzngsUFd0pYO8V9N3AxiFwCPYZMUFkUbc:k5yF6dzTUFd/O8nNlFwCPYZMUFkUbc
- TLSH
  T1D472F29597E60704783BCAD879D2C75F7B7C41028006CABDAAE7306C6F4D3DB91A2B45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral29 behavioral30
- Target
  styles/popup.css
- Size 14KB
- SHA256 2b04cd7ccf980a414d5e7b5dff2e496389d9fc249df9bdd8d6fb6f8a8c6d965a
- MD5 9de50e5e9149f31ed09527cab75937f8
- SHA1 f41b2b247ab7de1c79de2980bbf071855bd41517
- SHA512 f728d1f3ca0aac3446843defb707fac101b64ea352395e5187f777a41ccff4a5553c334c49d2c1f8545ae8f3f4d48cf2fb656be547f8e1f486b9de8a8dc55f0e
- SSDEEP 192:LUVEDnH4MvZbN+JKUz0Mq4KcQcK9YoiYAoAxiB3+VULKlW39c70k1q48c43:LUVEbrtCKHBh92DHSzb
- TLSH
  T1FD6262966BE10304753BC1A439D3CB6B772C9442A50BCE7DABD2305CAF8D1CBA572B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32