General
-
Target
be5a403330e4ff0bf352935e78082408774685a93bf07b587460cdf1f5d08ef8
-
Size
3.9MB
-
Sample
220516-pywwhsbhg7
-
MD5
a7536f97d342afa27ed93a07286f0822
-
SHA1
954b90bedb1c8b2adcd9b9ae83f02834254334f5
-
SHA256
be5a403330e4ff0bf352935e78082408774685a93bf07b587460cdf1f5d08ef8
-
SHA512
7f1937e5f21d9411da79e179bac1361a27a8e28f34cb84209c09b5d62f1bc33a9acb9664e0696797bed396f3c29d976fc8362aec47625ff8a0961557e6e71eb9
Static task
static1
Behavioral task
behavioral1
Sample
be5a403330e4ff0bf352935e78082408774685a93bf07b587460cdf1f5d08ef8.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
be5a403330e4ff0bf352935e78082408774685a93bf07b587460cdf1f5d08ef8
-
Size
3.9MB
-
MD5
a7536f97d342afa27ed93a07286f0822
-
SHA1
954b90bedb1c8b2adcd9b9ae83f02834254334f5
-
SHA256
be5a403330e4ff0bf352935e78082408774685a93bf07b587460cdf1f5d08ef8
-
SHA512
7f1937e5f21d9411da79e179bac1361a27a8e28f34cb84209c09b5d62f1bc33a9acb9664e0696797bed396f3c29d976fc8362aec47625ff8a0961557e6e71eb9
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Suspicious use of SetThreadContext
-