General
-
Target
27d8d47d152698385ec38731133c08095db31c962ef1472e6c90ae5a8d187d54
-
Size
4.7MB
-
Sample
220724-yf2hqaeaf5
-
MD5
ba75e1757e06004fb7ecbba60f6e02b4
-
SHA1
15b23a91f773df2647b81d8106746e07ec47c540
-
SHA256
27d8d47d152698385ec38731133c08095db31c962ef1472e6c90ae5a8d187d54
-
SHA512
6f20fc1aeee29ffee3f09a48fa421f9b8432d6456fbdc2d091af14a18e16310c5900d087c1a42d3be7634c67c098b1508a9cc46bc56f924ab821108d3ecd7709
Behavioral task
behavioral1
Sample
27d8d47d152698385ec38731133c08095db31c962ef1472e6c90ae5a8d187d54.exe
Resource
win7-20220715-en
Malware Config
Targets
-
-
Target
27d8d47d152698385ec38731133c08095db31c962ef1472e6c90ae5a8d187d54
-
Size
4.7MB
-
MD5
ba75e1757e06004fb7ecbba60f6e02b4
-
SHA1
15b23a91f773df2647b81d8106746e07ec47c540
-
SHA256
27d8d47d152698385ec38731133c08095db31c962ef1472e6c90ae5a8d187d54
-
SHA512
6f20fc1aeee29ffee3f09a48fa421f9b8432d6456fbdc2d091af14a18e16310c5900d087c1a42d3be7634c67c098b1508a9cc46bc56f924ab821108d3ecd7709
-
Glupteba payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-