General
-
Target
36326285711724b9b1ca284c7e539fec1117cccf6d0eea34348d7c4f5e43dfd6
-
Size
3.9MB
-
Sample
220509-ax436sbge8
-
MD5
ac16e40582b1451a21544ac8a06f1ffb
-
SHA1
c7f76879e789c21057bce7eecf10675705a5997b
-
SHA256
36326285711724b9b1ca284c7e539fec1117cccf6d0eea34348d7c4f5e43dfd6
-
SHA512
aae0cdbf8403dc8b00bdfb7060585acf51dfcaf4c330e66a31c09bce72f1704c1afa84e07fe905c64c2363124636d87437014601548f3cf65c4a6f9d9aeda11b
Static task
static1
Behavioral task
behavioral1
Sample
36326285711724b9b1ca284c7e539fec1117cccf6d0eea34348d7c4f5e43dfd6.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
36326285711724b9b1ca284c7e539fec1117cccf6d0eea34348d7c4f5e43dfd6
-
Size
3.9MB
-
MD5
ac16e40582b1451a21544ac8a06f1ffb
-
SHA1
c7f76879e789c21057bce7eecf10675705a5997b
-
SHA256
36326285711724b9b1ca284c7e539fec1117cccf6d0eea34348d7c4f5e43dfd6
-
SHA512
aae0cdbf8403dc8b00bdfb7060585acf51dfcaf4c330e66a31c09bce72f1704c1afa84e07fe905c64c2363124636d87437014601548f3cf65c4a6f9d9aeda11b
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
-