General
-
Target
556848f1d6b1c534ed925865de31a3d1669aac08d02674fd212762b6a15eaa49
-
Size
3.9MB
-
Sample
220516-twprmsddfq
-
MD5
0c19acdf6bfbf4ee34d547f2fd8b44e2
-
SHA1
e98b131e5f2ba6e06763061e71e41e3d56f8e845
-
SHA256
556848f1d6b1c534ed925865de31a3d1669aac08d02674fd212762b6a15eaa49
-
SHA512
8dde14e02743a994cac8365f43199a152afacdec7467280fd0870803d0cc596e687ad02e847e9a9feddbd4c0a90534947e3daeea8fa066853a93905ec4cd455e
Static task
static1
Behavioral task
behavioral1
Sample
556848f1d6b1c534ed925865de31a3d1669aac08d02674fd212762b6a15eaa49.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
556848f1d6b1c534ed925865de31a3d1669aac08d02674fd212762b6a15eaa49
-
Size
3.9MB
-
MD5
0c19acdf6bfbf4ee34d547f2fd8b44e2
-
SHA1
e98b131e5f2ba6e06763061e71e41e3d56f8e845
-
SHA256
556848f1d6b1c534ed925865de31a3d1669aac08d02674fd212762b6a15eaa49
-
SHA512
8dde14e02743a994cac8365f43199a152afacdec7467280fd0870803d0cc596e687ad02e847e9a9feddbd4c0a90534947e3daeea8fa066853a93905ec4cd455e
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-