General
-
Target
74846745333b001821e5641e3f037f5560f5098f4946516f9f0917f193c740e7
-
Size
3.8MB
-
Sample
220516-b58xrshae8
-
MD5
cc4fecd33a8843267f9841d480fc138a
-
SHA1
e5f28d9feef1a8a03d80add7bafc306e24e9c40c
-
SHA256
74846745333b001821e5641e3f037f5560f5098f4946516f9f0917f193c740e7
-
SHA512
fe345c8c9d9a9ce5578d57d3430f24788930742de70e9968aaa170c01a405bf58ae01b1010957029d4191f4af8fe3105c2abe26a70cc6f4154e121a9fb2b49ee
Static task
static1
Behavioral task
behavioral1
Sample
74846745333b001821e5641e3f037f5560f5098f4946516f9f0917f193c740e7.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
74846745333b001821e5641e3f037f5560f5098f4946516f9f0917f193c740e7
-
Size
3.8MB
-
MD5
cc4fecd33a8843267f9841d480fc138a
-
SHA1
e5f28d9feef1a8a03d80add7bafc306e24e9c40c
-
SHA256
74846745333b001821e5641e3f037f5560f5098f4946516f9f0917f193c740e7
-
SHA512
fe345c8c9d9a9ce5578d57d3430f24788930742de70e9968aaa170c01a405bf58ae01b1010957029d4191f4af8fe3105c2abe26a70cc6f4154e121a9fb2b49ee
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-