General
-
Target
b03de45f83162eb956470b508eed3c0ce373ffe4cbbcbb2f1d32c41eab8b842e
-
Size
3.9MB
-
Sample
220524-rr4znahhak
-
MD5
f824b250e4ff6f2606bc7bee0735d077
-
SHA1
fda1d267d34dc4d06bf40b06dad519350ab9b75e
-
SHA256
b03de45f83162eb956470b508eed3c0ce373ffe4cbbcbb2f1d32c41eab8b842e
-
SHA512
eaa405a84e94632f21c55f9951783d06159a7346df58ff6b5d08ff4860b8281620af4924bcad2d4fce071e80bddc85ed91fbb1044c5d0104e44a2f5679e1fc28
Static task
static1
Behavioral task
behavioral1
Sample
b03de45f83162eb956470b508eed3c0ce373ffe4cbbcbb2f1d32c41eab8b842e.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
b03de45f83162eb956470b508eed3c0ce373ffe4cbbcbb2f1d32c41eab8b842e
-
Size
3.9MB
-
MD5
f824b250e4ff6f2606bc7bee0735d077
-
SHA1
fda1d267d34dc4d06bf40b06dad519350ab9b75e
-
SHA256
b03de45f83162eb956470b508eed3c0ce373ffe4cbbcbb2f1d32c41eab8b842e
-
SHA512
eaa405a84e94632f21c55f9951783d06159a7346df58ff6b5d08ff4860b8281620af4924bcad2d4fce071e80bddc85ed91fbb1044c5d0104e44a2f5679e1fc28
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
-