General
-
Target
54621d23240e0d13c89ef7aaaab2fe5316355ac48e86b2af8ce629901328ebb6
-
Size
4.2MB
-
Sample
220725-x62qqsbgh9
-
MD5
fb0abe71241fb248abb144ee67f01da6
-
SHA1
952da25176bb0e606609500ea52edcf39fe7aec2
-
SHA256
54621d23240e0d13c89ef7aaaab2fe5316355ac48e86b2af8ce629901328ebb6
-
SHA512
6f18aeb13784c17d81c332da607b57e36b4d1da57a20f1f72e11cbfdaf83baafb1d01ffdab7829c68a41bfaef5cdfb6132c0084d4d56c6aa5e08ac6cb7de63f6
Behavioral task
behavioral1
Sample
54621d23240e0d13c89ef7aaaab2fe5316355ac48e86b2af8ce629901328ebb6.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
54621d23240e0d13c89ef7aaaab2fe5316355ac48e86b2af8ce629901328ebb6
-
Size
4.2MB
-
MD5
fb0abe71241fb248abb144ee67f01da6
-
SHA1
952da25176bb0e606609500ea52edcf39fe7aec2
-
SHA256
54621d23240e0d13c89ef7aaaab2fe5316355ac48e86b2af8ce629901328ebb6
-
SHA512
6f18aeb13784c17d81c332da607b57e36b4d1da57a20f1f72e11cbfdaf83baafb1d01ffdab7829c68a41bfaef5cdfb6132c0084d4d56c6aa5e08ac6cb7de63f6
-
Glupteba payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-