General
-
Target
38afc38b92ce46bef4b9f01b0c5103d119c3dbd5c0072520c6263ef2435e176b
-
Size
3.6MB
-
Sample
220516-b742lahbd3
-
MD5
d449078802a5330cc5553e49482a98ee
-
SHA1
3e6e62739a014a3711b17faa37ac729cb1d085c8
-
SHA256
38afc38b92ce46bef4b9f01b0c5103d119c3dbd5c0072520c6263ef2435e176b
-
SHA512
5f6fe11dd26e05fc4d8ab31e372b0ab2d54b20d1b3ab2be7459c3a9654c9ed6e749f58448411b9e17878ce0c7c3c098b1f24f0401ed8d2b7393910f1454897c2
Static task
static1
Behavioral task
behavioral1
Sample
38afc38b92ce46bef4b9f01b0c5103d119c3dbd5c0072520c6263ef2435e176b.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
38afc38b92ce46bef4b9f01b0c5103d119c3dbd5c0072520c6263ef2435e176b
-
Size
3.6MB
-
MD5
d449078802a5330cc5553e49482a98ee
-
SHA1
3e6e62739a014a3711b17faa37ac729cb1d085c8
-
SHA256
38afc38b92ce46bef4b9f01b0c5103d119c3dbd5c0072520c6263ef2435e176b
-
SHA512
5f6fe11dd26e05fc4d8ab31e372b0ab2d54b20d1b3ab2be7459c3a9654c9ed6e749f58448411b9e17878ce0c7c3c098b1f24f0401ed8d2b7393910f1454897c2
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Suspicious use of SetThreadContext
-