Roshade[.]zip | Triage™

resource	yara_rule
static1/unpack001/scripts/popup-bundle.js	RobloxShader_Malicious_BrowserExtension

resource	yara_rule
static1/unpack001/background.js	potential_ddr
static1/unpack001/manifest.json	potential_ddr
static1/unpack001/scripts/popup-bundle.js	potential_ddr
static1/unpack001/scripts/sw-bundle.js	potential_ddr

Roshade.zip

SHA256 30b89ccb5ddb559dd962bd419986fd66a7e119dfb8eca690adc25686be525f78
MD5 7ae348e97a19e4fdb734221be8c32e19
SHA1 49c5b2f19dc8016627cc023c1b7ef2291ea3f28c
SHA512 deaa09936364cc5e73e21cd39a9fb3e88cd34e241c3d0eaa8b65c843f321cc1f0cca2c29bd272a7a41b75c6325a5a4989b540a8e1ce9e4fe19d52ee9023ee496
SSDEEP 12288:IR11zrhoXqsdo04sR11zrhoXbmSTAZRIP2qs1jH2xvwhLI1fY:IR113hNs1R113hVPRdxb2lwhMFY
TLSH
T1CFC42311025C1623E793687D7B888A389836BAE1CA01DBC66F7AB41145992CFF3CF15F
MD5 SHA1 SHA512 SSDEEP TLSH

assets/slides/shader-1.jpg

SHA256 202373600fdd4ae9098d13b09a8034de6fdcce0b0e1e41ac00b665dff35c30d8
MD5 6f9856d9e41466334656979133b57919
SHA1 c00cf5f31adbbc02ecc9df2390b1b3a9d790027c
SHA512 b220418f1dd9c7429e48cb2465a164ea3079fd18bd965a2e892b48198bda030964c8d57e175199d507860c12eda3a9915a41397a9b8f657f62255371cf132592
SSDEEP 3072:viL8hwvj6f+iqOddlnx1fx9tJbnriFAdO2cNzXUS+qM:LCOMmdrrJbrih28zXVW
TLSH
T109A312115B5E47D3F34262FEBB08966C40F7E9F35717E5CA4AB9A42942092CF235B00D
MD5 SHA1 SHA512 SSDEEP TLSH

assets/slides/shader-2.jpg

SHA256 67147a0194970485057dd36a1acd799d9baf43fc38cc44e6d82d256d16762ac2
MD5 62fcd571f97975482660032db86165c1
SHA1 172b2d4d96f9aae2371589109a9f142dd5ff27f7
SHA512 3c9aa5ac31be233f23002b31fb7042d7a5c9514801616b9b8b745225aa5857c483f3adf27f0501c4adfb2c224e3f212ece92fe7455b770b5e56c5c060a00cdbc
SSDEEP 768:CbMPMDAhfzaJOwfujRdmjYq8/2i4tWHsMFnsd5fm/LSaOsjpKvihCevjyGDRjUmD:nPj5RjRoz8/tMrd5fW7ofvGDRjLaQR
TLSH
T139530242C721257AF710FC34532E5555F268B42AEF42F3E825C53EBBDC266CA5A2E190
MD5 SHA1 SHA512 SSDEEP TLSH

assets/slides/shader-3.jpg

SHA256 aeb07465967e35f4f508c16eabda260c877c8d584dfb4081c732af98bbd11777
MD5 9b0934a60c5d732095fd2004deb7e947
SHA1 53c919dd780ba9de022e81d4a7e14c898293a08b
SHA512 d3030bb9679945a865501562622b2b51df971ba3f5fa2dda6b005ca8209565e1d9ffa4781cbea4cf705007310739ea389b037ad75e5523aeea00042cb3df9c52
SSDEEP 1536:J58FznRn8dO0Y3dCkOzoTMVrvXBIBaI3YraTbTA0VQ1qt9gzq3HYw:J5mLRYXYhXM9XBIY+YrAVQkC+3Yw
TLSH
T17A7302C86750628BF62027B569BE0C63F6A6E300CF02D25F560D85C5C876D9BBE9970F
MD5 SHA1 SHA512 SSDEEP TLSH

assets/slides/shader-4.jpg

SHA256 c2cc822c580e6f817239d14bef483c0b40199044a48eba120c0b8b3a77130823
MD5 ba729e4eaa8fcf04dd78a43c50ecceb2
SHA1 2ae27ef83f9edcfc9335c81cf7ca4c624bb0636e
SHA512 8eb01bceef4b6f52ff7211be8105034fe40d3577c9533a438d8c18cb0d2f774c3605b438d6b11c5484ff326be897db72dee36e0fad9cbcbfbb319efc11eaebb8
SSDEEP 3072:lGnEu5nr7MJDMnekWgruMZ89kxw2dmdpw:lyE+r7MJwnvbuMJxw2qK
TLSH
T167A31203C6760E54FE916836F4066FA3EB41A2E9ABC3015B9FC10FF09901699891D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

background.js

SHA256 5ac44cf81ec4e139b09fe0837b8efcdbff7464f6a5dfab8af048a3f0ae4d74f0
MD5 935b185eadb67f23fd9956cffaec689f
SHA1 e6c3b91813ab73473e1bb552aae7ba45dea730d1
SHA512 c04b410f5bcb8841222349a8345cc6cbe56635c5b1601fe283b82554a190a2a692617cff3b249486cf117bc9033ebfe7aed8911741452a3154707b71ab763d2d
SSDEEP 384:E+ErlFbRA5McmT5ONoLDbsHP5jxILQHUdKdYRqoFd5K05ZUaag4S5fae58HS+iEw:yrlFbLFKvJ/0qHSAwHC7vsl0c
TLSH
T14C72A9BE34FA20295522A0BD455F9025B221E01375CDED78FA5CA1703FCC62949F6FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Detects references to legitimate web services potentially used as dead drop resolvers

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

network

icon128.png

SHA256 6a73381a20d442a38abe1871c63f7184fd1de6247ed9957511631b6a59b22717
MD5 4d5a50869ed62f376a78dd52b059d1d1
SHA1 783d26d74ed9c930d0350baee63e0fb3f8b7f212
SHA512 a952c1f9362c226e01765007432e0b175e43616848737ef39f3271cd116d2da706e5fbef50101865bffd033d914a0492f023ecf0c8b40321910bcd77ad5566d1
TLSH
T110714DE1A03876EF507E13DFE5DD90646B5FB4DD125908C4E18E2540FDF9A614A1C864
MD5 SHA1 SHA512 TLSH

icon16.png

SHA256 d5648bb5d084b1d0872e92e2a0cef193c64e1147c8930ee815957cdc5e48ffdb
MD5 148aa1dd079463ba70af984af60003cc
SHA1 7ca339f69dd2424d558a15c8164f5301d045b9e2
SHA512 dd98829ca9d82c3d82152e607f2dd77db6f829583d3d4c97b6a4502c51674b62cc777804d11010c444128dbabce754baf5fbf1680db22622de7e9ca398b49aa2
TLSH
T135F062450569B08AD790283637F380208AF0278FA50D22CE8FDFD01285085C6063BA41
MD5 SHA1 SHA512 TLSH

icon32.png

SHA256 0c3e457ed3760653dde843b278ec62198a8736b86f4c3fb8e94a20d067262951
MD5 837ba1c25d9ae0fb60218a963ccbeb65
SHA1 98d689e42e5808b7eb553e74b153dbf15a3b2565
SHA512 87bef133a774f526e91b3e5006e4d36d6f69363f3858ea10792b976723c46390eb43d4a4f3264950d269ce05247f284ff73adecd3312288ed799d92f0c49bd67
TLSH
T1B421E9AB34B2D97CD52F4817B5C24DC0A6DAADEF32A1DC56EC0DD813693D4019DD1358
MD5 SHA1 SHA512 TLSH

icon48.png

SHA256 6ce89fa9adf5673f0931fdabbba35632a0701e6b2a2b3ae81b7bede13ff30dfa
MD5 2437599556079c3d800f99d7cee409f5
SHA1 e5d0b61bb37a1e381225986bc6d832eb6289f33c
SHA512 9ed900f712122b19d39361def145c8144f3e6ce496924cee8ec42fefd93891be66bb7411aeefc2f765f26f1e9b0c8981c05655cf8ade2838654c2db62188f254
TLSH
T18D31F9EB06674855F0B108B8E1E30A21F72C1AFA4262D148D778AA7B4C0BA28C9F3611
MD5 SHA1 SHA512 TLSH

manifest.json

SHA256 5fb6f4a77a52bb3d707e01cc1ba4a310e307c56c32f90671742deb74b86272ae
MD5 f8956ff76f61f1dbc5f6bc7ab513a733
SHA1 1b039b86df3c08b00d37bfe4349ca44ddbede640
SHA512 534b63248f4c0e2b936e6fdd4c6f5b59f229a537875bcaab8a36325b0a3b38ee6a8f212289ecc791fa60f5429d7f392bd7ffb88ef237dc643fc4d4758d64fbd4
SSDEEP 96:/9mZSj6fy4unLsgsHPsjsqsssPiXYFjzFo50QjoVDorb4H5do7HC8vtsh1V:xH4uvZ00UdH5O7HC8v4
TLSH
T1DFE1B5EBC70498192B248996E464770DF607415F7CCABD8AF320843E5F8CDEF6879268
MD5 SHA1 SHA512 SSDEEP TLSH

Detects references to legitimate web services potentially used as dead drop resolvers

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

network

popup-shader.js

SHA256 532968e40e582f28c0e5c05920d4699e4fc869d62d3fb60ec3cd3f1cb30c78cb
MD5 2441b1e07bd59dc29b8be223e517e61c
SHA1 51484d89e236537b94138453f01cf7bcb4942da8
SHA512 ffce596848b2b4dc87a114dc194cacaf5f732bf53bf1b9948c212d80363e7645a62d9ebe2a2377779c3525c0106094edc3320abfd18c7a89c56b315e1e507cab
SSDEEP 192:JId7CslbAefsjVTlA/A1Fe7kvk3xaM8P/zRBdOcyRySLBT8RdQGuobp9zGeP9BgT:iZjQBkgDXAT8RTP9BgVIf8CL3XNN2
TLSH
T11A52846D34E3287A9073B0F99B8F959975116853084ACD207C2CD624AFF04BDAF71BE9
MD5 SHA1 SHA512 SSDEEP TLSH

popup.css

SHA256 f19d61000614be79e368fc04d0e9992a8fa28eeb50fb2887e73a5a0f58d0a145
MD5 0a1223352fda2ae3e722667bc93f44cf
SHA1 a8a1724a64beb0f3c0a8b7bea588271f57ecb00c
SHA512 6321e17d178bfd11dbd1b61b0792689d2ab44caf25cfd587296ecce82b4f26169345a2bbc2ae2792edbc836af877606e76848c70ca452de477243e85bdf392e7
SSDEEP 192:KZxpT8+MOCrN9cxhzPxZK/eP7SqyrpqdhQEFTHRJqdu9N:KPS9kXzjtP7ipsR
TLSH
T1164274A26FD90504B83FB5D479D3CF8BE39998019419D9BCABD1101C8E8E2DCF965F88
MD5 SHA1 SHA512 SSDEEP TLSH

popup.html

SHA256 981f48fee5ec84fee5b94ac449e396b2c7b3b5a552d58b4e8d38ff3a1d2cdab5
MD5 4043d0edee2521e9f12e35321ea27e24
SHA1 f26569fbe61d266611e968f95925e2cb73badf10
SHA512 a294f64e5ef0558cdbc522aadc5f94afe909d69b071daf038225fe9036fe199caa593141709180b073d9f3c6edad94126cdd7cc5f796949b4bb20f411e56abc1
TLSH
T181715D6051F0242A005380C5A7A55E5B6D85EF47DE9E4181F6BD5BE80FFBC92FC2B11B
MD5 SHA1 SHA512 TLSH

preview.jpg

SHA256 202373600fdd4ae9098d13b09a8034de6fdcce0b0e1e41ac00b665dff35c30d8
MD5 6f9856d9e41466334656979133b57919
SHA1 c00cf5f31adbbc02ecc9df2390b1b3a9d790027c
SHA512 b220418f1dd9c7429e48cb2465a164ea3079fd18bd965a2e892b48198bda030964c8d57e175199d507860c12eda3a9915a41397a9b8f657f62255371cf132592
SSDEEP 3072:viL8hwvj6f+iqOddlnx1fx9tJbnriFAdO2cNzXUS+qM:LCOMmdrrJbrih28zXVW
TLSH
T109A312115B5E47D3F34262FEBB08966C40F7E9F35717E5CA4AB9A42942092CF235B00D
MD5 SHA1 SHA512 SSDEEP TLSH

profile.json

SHA256 391f9b6878091f12bd364dc8657dabcc354a439b4bdb05a77f4ba8f7e37cf721
MD5 2cb1f222b8f98043fe003e29ae85470a
SHA1 69f4ff1aa66cbbb4276ea744815b8f1789069062
SHA512 5b509728fca6e771f7998b1c9c70aaf52982bf4c320b803471e9aca3f1b850de43a4f59944afed0fd74f64508d14c85e0b963c6b3ced42606f9069020ce9057d
TLSH
T18FC08C73F8A6380F00D2D080987D7AC368934E28064BE4210E60005E52EFC2C9B00B2B
MD5 SHA1 SHA512 TLSH

roshade-icon.svg

SHA256 8e515d1fa638d8339415b2a1b182785fa04d8dbd077e794aa0e0c03ca548c275
MD5 8ba1d54787fe3ea90215b8fa80e8fcf7
SHA1 233733835884f5bb80258b5680e2dbd2d85a25f2
SHA512 86263b7ff3c3bfd331345aeea2593152c19b150eb907ccd95296cbf5346f6f4c21c26eda7f26e8d8ba255df5416c0e6288c59774558596234fbffc1ebb907bcb
TLSH
T1D4E02BA7E14C11148D2087086728E4A9D413F5CE8B44541CDF90B9A4BCB80EFBDED2DF
MD5 SHA1 SHA512 TLSH

svg

roshade-mark.svg

SHA256 f12560b86e86f1d9128fabe7525fb735d8392b08781832b2f836610b7658da84
MD5 7b23c367de4c6b91343e096c7ae91e68
SHA1 415499ba7ed45bd58981e26cdf541d929228cae4
SHA512 4f50ef139e452c0db5cb08dfff36789a5c941852e81f17cb537ece9dd9a619aae5fee5d8a543e5ea9ab9270f3f78f9eae578252f43005b5cbccb6a490ebf95f9
TLSH
T187D0C269E0AC6529D610DB026DB834ED7B0FA0CD9306C18AB6C51F71426A8AAB4059A8
MD5 SHA1 SHA512 TLSH

svg

scripts/popup-bundle.js

SHA256 9aa12218d21091729afb521935668b83b84ec12d3af7ec97eee8884fed7a66d9
MD5 45214fa1466007e493a5639ec27f3e91
SHA1 eed0de066ef4ed9f18da6af5c33d8374a31da691
SHA512 7bdac29132e17db14c743bb1bd09bb634e278404f1ec33f8cf0007c9bcbf6882f459c5e39e3897bf5c38b13b48d71914cefcf307ee9653dca3ffed8d6e740a18
SSDEEP 3072:PnTrhybjqHz0vPA2kwU4JG+u+f1m9GhjWLVpmeJ/xeA99X1h1777b7Ya:PnMIz884Vu+fMIWvesJ
TLSH
T17C54DAAE24F720260563707C9B9FA005B235D023288DEDA4BD5C9324AFC5E3956F6FD9
MD5 SHA1 SHA512 SSDEEP TLSH

Malicious Roblox shader browser extension

Detects Roblox shader lures combined with browser-extension access and credential/session theft or remote exfiltration.

stealer browser_extension roblox
Detects references to legitimate web services potentially used as dead drop resolvers

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

network

scripts/sw-bundle.js

SHA256 ac14d98fc3ad19595e94ae00f34aed7c603bc11089a866e2d10af42a4aab0f42
MD5 90fc77d5074f300a986ccf12c6b81ee0
SHA1 a7c08b5b1bafcd6752be5ae1d6cf190783564494
SHA512 b81da1c2576d65728dd9a82573a1f3646b2a82b3c7911724e14c61b0d532181b978cef46733dfd30f714982dbe41215fe4369c6bb88823d4584b01ad0b0aa45e
SSDEEP 1536:y5oDFVrPO3i2kb47Q7QLBXxzUlkXCib/40EaCvGQV+n1ki/ZQZDUikOtWsBKBKdi:HrGybjqHz0vPA2kwU4Jw
TLSH
T1CDF3A8BA14F720250A63707C5B9F6005B23590136C8CFDD4BE9C8624AFC9D396AB6FD9
MD5 SHA1 SHA512 SSDEEP TLSH

Detects references to legitimate web services potentially used as dead drop resolvers

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

network

settings.js

SHA256 0fab9d2404cce92d448c144ab43a7f13812718520bc578ab3f77b3ad8abf5502
MD5 7429047ce0c4b5048506c8b178dd7946
SHA1 7bd029f721e5d85fca213161e3c2e05192761836
SHA512 7ddee83850d6ecc499c41ab6e7f007fdc55760caa0cce40d030fc3bea36b8695024a6fbbdca47e84781459a3fd0f72497aadbbe8d5535b7fa18a0255a822b782
TLSH
T130A022232C3223CC00002B008F003880A80CFA0E0B33C8003880C0F0C02BF032C80CA2
MD5 SHA1 SHA512 TLSH

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

File Explorer

Roshade.zip

assets/slides/shader-1.jpg

assets/slides/shader-2.jpg

assets/slides/shader-3.jpg

assets/slides/shader-4.jpg

background.js

icon128.png

icon16.png

icon32.png

icon48.png

manifest.json

popup-shader.js

popup.css

popup.html

preview.jpg

profile.json

roshade-icon.svg

roshade-mark.svg

scripts/popup-bundle.js

scripts/sw-bundle.js

settings.js