General
-
Target
9cf75e7ce9721c241abd8d1e07549f87d1b1bafdd72e3ed2df5034cc22991b11
-
Size
3.8MB
-
Sample
220520-1fth8ahafj
-
MD5
662bc6ae7788dc93c3ac59e475a2e537
-
SHA1
1224f0806c6ae64ea733c4e4d9e9cc8af7ea07ae
-
SHA256
9cf75e7ce9721c241abd8d1e07549f87d1b1bafdd72e3ed2df5034cc22991b11
-
SHA512
bb48a8117d62bb7e0f324dca293a119f855da65391d478745d0dedb072cd1651a08042a37475e767cf4c42b3e2676062b29378e346e708c13c7f32eb17e50bb6
Static task
static1
Behavioral task
behavioral1
Sample
9cf75e7ce9721c241abd8d1e07549f87d1b1bafdd72e3ed2df5034cc22991b11.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
9cf75e7ce9721c241abd8d1e07549f87d1b1bafdd72e3ed2df5034cc22991b11
-
Size
3.8MB
-
MD5
662bc6ae7788dc93c3ac59e475a2e537
-
SHA1
1224f0806c6ae64ea733c4e4d9e9cc8af7ea07ae
-
SHA256
9cf75e7ce9721c241abd8d1e07549f87d1b1bafdd72e3ed2df5034cc22991b11
-
SHA512
bb48a8117d62bb7e0f324dca293a119f855da65391d478745d0dedb072cd1651a08042a37475e767cf4c42b3e2676062b29378e346e708c13c7f32eb17e50bb6
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
-