General
-
Target
4de2e69e1c144caeb6904b7b7400d065aab4be63c60c3703cb77cf9ce76c5eb7
-
Size
3.8MB
-
Sample
220516-p27r7acbg3
-
MD5
df567ded7c6765d2cd9cb2391aef3606
-
SHA1
a84671f58d1cc0a382b647fa8f07b61bee7b74af
-
SHA256
4de2e69e1c144caeb6904b7b7400d065aab4be63c60c3703cb77cf9ce76c5eb7
-
SHA512
6a4f8bcda29b06b9cf88ee6cc5e5a89d8b56ea97890613cea888bf8548eb448dce58bdcdfbffac3b44864d57a73be07d5639a008d2a18480f045957dcea4071d
Static task
static1
Behavioral task
behavioral1
Sample
4de2e69e1c144caeb6904b7b7400d065aab4be63c60c3703cb77cf9ce76c5eb7.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
4de2e69e1c144caeb6904b7b7400d065aab4be63c60c3703cb77cf9ce76c5eb7
-
Size
3.8MB
-
MD5
df567ded7c6765d2cd9cb2391aef3606
-
SHA1
a84671f58d1cc0a382b647fa8f07b61bee7b74af
-
SHA256
4de2e69e1c144caeb6904b7b7400d065aab4be63c60c3703cb77cf9ce76c5eb7
-
SHA512
6a4f8bcda29b06b9cf88ee6cc5e5a89d8b56ea97890613cea888bf8548eb448dce58bdcdfbffac3b44864d57a73be07d5639a008d2a18480f045957dcea4071d
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Suspicious use of SetThreadContext
-