General
-
Target
c0eaeb74f499c373185e92dbff9001a5ec47326f5bf6006b25743fb6c71b9b8c
-
Size
3.8MB
-
Sample
220524-bc2mzsbab2
-
MD5
6462add1c1da1ee8a43b87583ffb2aa9
-
SHA1
3d302f71fca2fa39345aa6126ebc61962fc896ad
-
SHA256
c0eaeb74f499c373185e92dbff9001a5ec47326f5bf6006b25743fb6c71b9b8c
-
SHA512
e225bd2b2bf1c7bf81924c7cc6d873c7456b1bfb3ade3dd6167badb902e7b342b4183a939fcce0162fb7c2304de0fde5d40cad4ce7ebe3296acd6714dcaec0f2
Static task
static1
Behavioral task
behavioral1
Sample
c0eaeb74f499c373185e92dbff9001a5ec47326f5bf6006b25743fb6c71b9b8c.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
c0eaeb74f499c373185e92dbff9001a5ec47326f5bf6006b25743fb6c71b9b8c
-
Size
3.8MB
-
MD5
6462add1c1da1ee8a43b87583ffb2aa9
-
SHA1
3d302f71fca2fa39345aa6126ebc61962fc896ad
-
SHA256
c0eaeb74f499c373185e92dbff9001a5ec47326f5bf6006b25743fb6c71b9b8c
-
SHA512
e225bd2b2bf1c7bf81924c7cc6d873c7456b1bfb3ade3dd6167badb902e7b342b4183a939fcce0162fb7c2304de0fde5d40cad4ce7ebe3296acd6714dcaec0f2
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
-