Overview

overview

7

Static

static

4

Rbx2Source.exe

windows10-2004-x64

7

Rbx2Source.exe

windows11-ltsc_2024-x64

7

costura.dll

windows10-2004-x64

1

costura.dll

windows11-ltsc_2024-x64

1

costura.pdb

windows10-2004-x64

3

costura.pdb

windows11-ltsc_2024-x64

3

discordrpc.dll

windows10-2004-x64

1

discordrpc.dll

windows11-ltsc_2024-x64

1

discordrpc.pdb

windows10-2004-x64

3

discordrpc.pdb

windows11-ltsc_2024-x64

3

newtonsoft.json.dll

windows10-2004-x64

1

newtonsoft.json.dll

windows11-ltsc_2024-x64

1

robloxfileformat.dll

windows10-2004-x64

1

robloxfileformat.dll

windows11-ltsc_2024-x64

1

robloxfileformat.pdb

windows10-2004-x64

3

robloxfileformat.pdb

windows11-ltsc_2024-x64

3

system.dia...ce.dll

windows10-2004-x64

1

system.dia...ce.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Rbx2Source.exe
  • Size 8.2MB
  • Sample260912-mt3r6avapf
  • SHA256 43298ca3117a32a1081009466e3b006f106d53eb6ab1de6f9dbf2fbd67a68cc8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
costuradiscoveryexecutionpacker

Malware Config

Targets

    • Target
      Rbx2Source.exe
    • Size 8.2MB
    • SHA256 43298ca3117a32a1081009466e3b006f106d53eb6ab1de6f9dbf2fbd67a68cc8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    costuradiscoverypacker

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2
    • Target
      costura.dll
    • Size 4KB
    • SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      costura.pdb
    • Size 2KB
    • SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      discordrpc.dll
    • Size 82KB
    • SHA256 0083db1250991e06ca30017c7574921463920681e8f42ed1b2fcdada1515326c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      discordrpc.pdb
    • Size 27KB
    • SHA256 ef6ee4019690389c04289ea9324bc44049a4f4389c64a4c36020a8085b4ecbb7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      newtonsoft.json.dll
    • Size 695KB
    • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      robloxfileformat.dll
    • Size 384KB
    • SHA256 01555f55102e629e8f287bb8bd0ada481529638c06d3b9a5d3951fa718039c36
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      robloxfileformat.pdb
    • Size 747KB
    • SHA256 487f0025313c2c508aa4a4146d41d19cbd1dfdd6cf4bc0d29242e34b153bb311
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      system.diagnostics.diagnosticsource.dll
    • Size 34KB
    • SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18

MITRE ATT&CK Enterprise v16

Tasks