General
-
Target
6652c9c28885273d81c5984fe158f80c1625d39914ef7f71bcebc2286c74a3a3
-
Size
3.7MB
-
Sample
220512-n2sgtsddg9
-
MD5
7726c497cf62a30e4613c3850fd97abb
-
SHA1
d010f38cc1bea5cc1f65e459719afa86e15fe59f
-
SHA256
6652c9c28885273d81c5984fe158f80c1625d39914ef7f71bcebc2286c74a3a3
-
SHA512
e43cf24d4284ce89ea202194bc329ce4781d1eeca6bd2db4f2775960dc3c2ac4b0cf1acc549a16adb177a90bb0c40fa4ad44b96679280e12ac16fd7c7656f550
Static task
static1
Behavioral task
behavioral1
Sample
6652c9c28885273d81c5984fe158f80c1625d39914ef7f71bcebc2286c74a3a3.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
6652c9c28885273d81c5984fe158f80c1625d39914ef7f71bcebc2286c74a3a3
-
Size
3.7MB
-
MD5
7726c497cf62a30e4613c3850fd97abb
-
SHA1
d010f38cc1bea5cc1f65e459719afa86e15fe59f
-
SHA256
6652c9c28885273d81c5984fe158f80c1625d39914ef7f71bcebc2286c74a3a3
-
SHA512
e43cf24d4284ce89ea202194bc329ce4781d1eeca6bd2db4f2775960dc3c2ac4b0cf1acc549a16adb177a90bb0c40fa4ad44b96679280e12ac16fd7c7656f550
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-