MALICIOUS — RobloxPlayerExecutor.so
MALICIOUS — RobloxPlayerExecutor.so is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (80/100), attributed to the HUILoader family. 3 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
01f2d1fe1291438c7bb6cd8da5d7139a40a87ab8fc4478a1732e671eae51f1f4 - SHA-1:
2900cecd8058a437e1546d8cbd9bf488b000d4bf - MD5:
7cbc28a11e8eeeb4c4e9aeaf78fff956 - imphash:
0dc27527033d7c2c93eadbdfaf086d19 - ssdeep:
49152:rJsXzh1h0+PZXqwv1Zngn/QNmC1Ir/rPtjs+JgwxETIl02b8RjdG:c1n3ngn/JC1IrjtgNN - TLSH:
T1D25DBE6281037022F0B7F498BC7494ECD802F4FCA675488DA34BE56D529AE7BF5E0265 - Submitted as: RobloxPlayerExecutor.so
- File type: pe · Size: 2703872 bytes
- Verdict: malicious (80/100) · Family: HUILoader
Detections (3 of 56 engines)
- capa (capabilities): capability:collection/keylog
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
Why this verdict
The malicious score of 80/100 is the fusion of 5 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://www.verisign.com/rpa
- https://github.com/dharma
- https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage
- https://raw.githubusercontent.com/luau/UniversalSynSaveInstance/main/
Embedded domains
- www.verisign.com
- github.com
- 2scripts.sil.org
- raw.githubusercontent.com
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report