General
-
Target
812872dda38ac1812ea6730ccc6cb52391274b02301d22f7669e6b2a09bfddb9
-
Size
3.5MB
-
Sample
220516-cjzmmshhc5
-
MD5
d71b162c85633a294672d04792b37a49
-
SHA1
502b96d93c2ab8acecef5ce197763d839c2d155d
-
SHA256
812872dda38ac1812ea6730ccc6cb52391274b02301d22f7669e6b2a09bfddb9
-
SHA512
798b10915b3407096873086152025282d268256ba7ebac13768aba5c62178f3a44371e42e4ff6d8b2e43a099f961d9b02ee5a433173f5f699bc4e2351e24cb90
Static task
static1
Behavioral task
behavioral1
Sample
812872dda38ac1812ea6730ccc6cb52391274b02301d22f7669e6b2a09bfddb9.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
812872dda38ac1812ea6730ccc6cb52391274b02301d22f7669e6b2a09bfddb9
-
Size
3.5MB
-
MD5
d71b162c85633a294672d04792b37a49
-
SHA1
502b96d93c2ab8acecef5ce197763d839c2d155d
-
SHA256
812872dda38ac1812ea6730ccc6cb52391274b02301d22f7669e6b2a09bfddb9
-
SHA512
798b10915b3407096873086152025282d268256ba7ebac13768aba5c62178f3a44371e42e4ff6d8b2e43a099f961d9b02ee5a433173f5f699bc4e2351e24cb90
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Suspicious use of SetThreadContext
-