General
-
Target
be127f00c805740a6a9e3eb8de6f3ba9ac68101de0f9dbcb41595b91c8d3a76f
-
Size
3.8MB
-
Sample
220520-2wmw2sgbb7
-
MD5
84dbc916b21ee7dd49131e4bb996c3b0
-
SHA1
cbff0b9a2ca635515722798efb84f53694300afa
-
SHA256
be127f00c805740a6a9e3eb8de6f3ba9ac68101de0f9dbcb41595b91c8d3a76f
-
SHA512
d547238b6ddf466b1ab4945f951325e005ef7f9661bf28c9f3fa407eb4169520c16e613f02b646f8443fc383efe8e2e2775689a000540c29c444e355d60a8377
Static task
static1
Behavioral task
behavioral1
Sample
be127f00c805740a6a9e3eb8de6f3ba9ac68101de0f9dbcb41595b91c8d3a76f.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
be127f00c805740a6a9e3eb8de6f3ba9ac68101de0f9dbcb41595b91c8d3a76f
-
Size
3.8MB
-
MD5
84dbc916b21ee7dd49131e4bb996c3b0
-
SHA1
cbff0b9a2ca635515722798efb84f53694300afa
-
SHA256
be127f00c805740a6a9e3eb8de6f3ba9ac68101de0f9dbcb41595b91c8d3a76f
-
SHA512
d547238b6ddf466b1ab4945f951325e005ef7f9661bf28c9f3fa407eb4169520c16e613f02b646f8443fc383efe8e2e2775689a000540c29c444e355d60a8377
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-