File name:

Roblx Cheats .exe

Full analysis: https://app.any.run/tasks/218f5426-0389-41c6-945c-5fd7ef2fed87
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 08:31:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
remote
securityxploded
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

82D5D2D666446A7DF24D9824AF9884B8

SHA1:

1BEF21FC971110F52AE801DDDE2EBC27A50A60A7

SHA256:

0383785DEB9DB9CC6A87F7B511C8D855FAB95DB937611F3DBF33393B2EF6A345

SSDEEP:

384:7GaqtREU9twsodxOvC4XeK99KjGn2pssIJqqah0I8ZumTG3IBL+EcoinblneHQM+:UtREWmOvbXe8IGnLJqqiD8ZuSNuzfcI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Roblx Cheats .exe (PID: 2980)

    • Drops the executable file immediately after the start

      • Roblx Cheats .exe (PID: 2980)

    • NJRAT has been detected (SURICATA)

      • Roblx Cheats .exe (PID: 2980)

    • Connects to the CnC server

      • Roblx Cheats .exe (PID: 2980)

    • NJRAT has been detected (YARA)

      • Roblx Cheats .exe (PID: 2980)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3388)
      • Roblx Cheats .exe (PID: 2980)

    • Steals credentials

      • vbc.exe (PID: 3388)

    • Steals credentials from Web Browsers

      • vbc.exe (PID: 3388)
      • Roblx Cheats .exe (PID: 2980)

    • SecurityXploded is detected

      • vbc.exe (PID: 3388)

    • Changes the autorun value in the registry

      • Roblx Cheats .exe (PID: 2980)

    • NjRAT is detected

      • Roblx Cheats .exe (PID: 2980)

  • SUSPICIOUS

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Roblx Cheats .exe (PID: 2980)

    • Connects to unusual port

      • Roblx Cheats .exe (PID: 2980)

    • The process executes VB scripts

      • Roblx Cheats .exe (PID: 2980)

    • Reads the Internet Settings

      • vbc.exe (PID: 3388)
      • Roblx Cheats .exe (PID: 2980)

  • INFO

    • Checks supported languages

      • Roblx Cheats .exe (PID: 2980)
      • wmpnscfg.exe (PID: 1556)
      • vbc.exe (PID: 3388)

    • Creates files or folders in the user directory

      • Roblx Cheats .exe (PID: 2980)

    • Reads the computer name

      • Roblx Cheats .exe (PID: 2980)
      • wmpnscfg.exe (PID: 1556)
      • vbc.exe (PID: 3388)

    • Reads Environment values

      • Roblx Cheats .exe (PID: 2980)

    • Reads the machine GUID from the registry

      • Roblx Cheats .exe (PID: 2980)
      • vbc.exe (PID: 3388)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1556)

    • Create files in a temporary directory

      • Roblx Cheats .exe (PID: 2980)
      • vbc.exe (PID: 3388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2980) Roblx Cheats .exe
C245.153.230.56
Ports25264
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\73fcd7a7907fbbeafe1fb23fee56d70d
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:02 09:31:07+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 35840
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0xabbe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT roblx cheats .exe netsh.exe no specs wmpnscfg.exe no specs #SECURITYXPLODED vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
1556"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2144netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" "Roblx Cheats .exe" ENABLEC:\Windows\System32\netsh.exe—Roblx Cheats .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2980"C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\roblx cheats .exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2980) Roblx Cheats .exe
C245.153.230.56
Ports25264
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\73fcd7a7907fbbeafe1fb23fee56d70d
Splitter|'|'|
Versionim523
3388"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\admin\AppData\Local\Temp\4497665"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Roblx Cheats .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
Total events
1 611
Read events
1 474
Write events
137
Delete events
0

Modification events

(PID) Process:(2144) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2980) Roblx Cheats .exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:73fcd7a7907fbbeafe1fb23fee56d70d
Value:
"C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" ..
(PID) Process:(3388) vbc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3388) vbc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3388vbc.exeC:\Users\admin\AppData\Local\Temp\Login Databinary
MD5:52E51471E9281235323F633CD0DEA56C
SHA256:147F3137B387FE4FBE3215B7864568404580A799D031009FE9C718F4C2EF87D0
2980Roblx Cheats .exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\73fcd7a7907fbbeafe1fb23fee56d70d.exeexecutable
MD5:82D5D2D666446A7DF24D9824AF9884B8
SHA256:0383785DEB9DB9CC6A87F7B511C8D855FAB95DB937611F3DBF33393B2EF6A345
3388vbc.exeC:\Users\admin\AppData\Local\Temp\4497665text
MD5:E4BF4F7ACCC657622FE419C0D62419AB
SHA256:B32FA68B79C5A7CEAA89E8E537EFE33A963C499666202611329944BD2C09318E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
1
Threats
9

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2980
Roblx Cheats .exe
45.153.230.56:25264
—
MIRholding B.V.
DE
unknown
2980
Roblx Cheats .exe
162.125.66.15:443
dl.dropbox.com
DROPBOX
DE
malicious

DNS requests

Domain
IP
Reputation
dl.dropbox.com
  • 162.125.66.15
shared

Threats

PID
Process
Class
Message
2980
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
2980
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
2980
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
2980
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Microphone)
2980
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Microphone)
2980
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Microphone)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblx Cheats .exe