General
- Target RobloxStudioInstaller.exe
- Size 9.6MB
- Sample261009-1debhswt5l
- SHA256 1fd94ed0ce29148795374939b1f58c65bc3f2bf8fe7c7416f2aaf9c069a121e4
- MD5 e90c385415acc105def8a2170a82363f
- SHA1 3ad04d79307daa9ce39cd7cb10da6c8e140b2aba
- SHA512 f77dfc6c1e6c38b58f6f7c253b039fabbee4e5ebe5e2edad87a2ade531ba4d4b5864a96455e99768d2c0f4aaa99b6828f1c8b7f662803ba43987a6dedd10d66e
- SSDEEP 196608:ey0xhEz4kAlLAR1ss29msxpd87NByR7XalYZjFa:eoLAG29msxL85ByR7Xno
- TLSH T18AA6BF22B900C032E8D200F2A6BD6FBA597C9A340B3954D7A7D49DBD59305D33B39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RobloxStudioInstaller.exe
Resource
win10v2004-20260911-en
19 signatures
900 seconds
Behavioral task
behavioral2
Sample
RobloxStudioInstaller.exe
Resource
win11ltsc2024-20260911-en
31 signatures
900 seconds
Malware Config
Targets
-
- Target RobloxStudioInstaller.exe
- Size 9.6MB
- SHA256 1fd94ed0ce29148795374939b1f58c65bc3f2bf8fe7c7416f2aaf9c069a121e4
- MD5 e90c385415acc105def8a2170a82363f
- SHA1 3ad04d79307daa9ce39cd7cb10da6c8e140b2aba
- SHA512 f77dfc6c1e6c38b58f6f7c253b039fabbee4e5ebe5e2edad87a2ade531ba4d4b5864a96455e99768d2c0f4aaa99b6828f1c8b7f662803ba43987a6dedd10d66e
- SSDEEP 196608:ey0xhEz4kAlLAR1ss29msxpd87NByR7XalYZjFa:eoLAG29msxL85ByR7Xno
- TLSH T18AA6BF22B900C032E8D200F2A6BD6FBA597C9A340B3954D7A7D49DBD59305D33B39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.