f69d68b65a05f873262eab8fa74e94f285c8be35741763bf7f0adb7bdf6d1048

General

Target
Roblox-windows-amd64-b10ef714.exe
Size 16.1MB
Sample261024-ynb8ssbz41
SHA256 f69d68b65a05f873262eab8fa74e94f285c8be35741763bf7f0adb7bdf6d1048
MD5 21219895459a0de4c0a7d64e47c56534
SHA1 1650818902611c105efc898fdeb691d196c7df2a
SHA512 368a0800ca95752f6cabd7b2067495e3f9d24817dc2d8a496214f4c1949e263dd9f886c493957858eb5917e2192cf9917b217754fd679789824b0fdb08b5fba9
SSDEEP 98304:RAS+MhpURvSH4F7t56SRULhmXlZDG6cc8AtFE3L5Nmm+KQ6DV6xh/alXHj:J5zOSHARXlJGbpJDA/alXD
TLSH
T136074A17E86605E9C0ADC6358566A663BB307C89473123D71B90F6247F3BBD0AEFA314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Roblox-windows-amd64-b10ef714.exe
- Size 16.1MB
- SHA256 f69d68b65a05f873262eab8fa74e94f285c8be35741763bf7f0adb7bdf6d1048
- MD5 21219895459a0de4c0a7d64e47c56534
- SHA1 1650818902611c105efc898fdeb691d196c7df2a
- SHA512 368a0800ca95752f6cabd7b2067495e3f9d24817dc2d8a496214f4c1949e263dd9f886c493957858eb5917e2192cf9917b217754fd679789824b0fdb08b5fba9
- SSDEEP 98304:RAS+MhpURvSH4F7t56SRULhmXlZDG6cc8AtFE3L5Nmm+KQ6DV6xh/alXHj:J5zOSHARXlJGbpJDA/alXD
- TLSH
  T136074A17E86605E9C0ADC6358566A663BB307C89473123D71B90F6247F3BBD0AEFA314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2