Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\RBX-902D0F50.tmp' (downloaded from the Internet)
Executes the following:
- '%TEMP%\RBX-902D0F50.tmp'
Modifies file system:
Creates the following files:
- %TEMP%\RBX-902D0F50.tmp
- %TEMP%\RBX-E0D45539.log
Network activity:
Connects to:
- 'se###.roblox.com':80
- 'cl#######tings.api.roblox.com':80
TCP:
HTTP GET requests:
- http://se###.roblox.com/cdn.txt
- http://se###.roblox.com/MZ�-RobloxPlayerLauncher.exe
- http://se###.roblox.com/MZ�-RobloxVersion.txt
- http://cl#######tings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?ap#########################################
- http://se###.roblox.com/version?gu#######
UDP:
- DNS ASK se###.roblox.com
- DNS ASK cl#######tings.api.roblox.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
