General
-
Target
7d6252a0581bc43ac81e53210cbca042202ac43acec17dfe59eca5cea30dfdd8
-
Size
3.7MB
-
Sample
220512-n2q9rsddg8
-
MD5
a6996f92201f52dfbfd85c841d6c8d04
-
SHA1
48a880fbd32d897ae019d1b1237aad3e7586ee2b
-
SHA256
7d6252a0581bc43ac81e53210cbca042202ac43acec17dfe59eca5cea30dfdd8
-
SHA512
d49ccb8cee040ce46c24f14439141fbf3d2eacbb16c76afbf504bfb865e5135c9e02f32d4e4db720e1de29688e6630f4f1d37df041b3c6631db0f756919a5fbe
Static task
static1
Behavioral task
behavioral1
Sample
7d6252a0581bc43ac81e53210cbca042202ac43acec17dfe59eca5cea30dfdd8.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
7d6252a0581bc43ac81e53210cbca042202ac43acec17dfe59eca5cea30dfdd8
-
Size
3.7MB
-
MD5
a6996f92201f52dfbfd85c841d6c8d04
-
SHA1
48a880fbd32d897ae019d1b1237aad3e7586ee2b
-
SHA256
7d6252a0581bc43ac81e53210cbca042202ac43acec17dfe59eca5cea30dfdd8
-
SHA512
d49ccb8cee040ce46c24f14439141fbf3d2eacbb16c76afbf504bfb865e5135c9e02f32d4e4db720e1de29688e6630f4f1d37df041b3c6631db0f756919a5fbe
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-