General
-
Target
e18457d640edde2ec7adf7adbae9d4cc6d3fd4774f9d4d69c9b7d3a5c34fdb6e
-
Size
6.5MB
-
Sample
220731-g41gwsdddn
-
MD5
1090fff2e77ef8af4bdad1a4247d98e8
-
SHA1
e03bc98212c50d408b357a62150baaed89d7d5bd
-
SHA256
e18457d640edde2ec7adf7adbae9d4cc6d3fd4774f9d4d69c9b7d3a5c34fdb6e
-
SHA512
71d42ddfb6e59b4e775465bc08bcbadc02fb62b57dc2b079ff7b9b09ea9b252697c86ab0e44c4aadc6e504866cdb199d9806a3837940b05ff771456c8ea03b66
Static task
static1
Behavioral task
behavioral1
Sample
e18457d640edde2ec7adf7adbae9d4cc6d3fd4774f9d4d69c9b7d3a5c34fdb6e.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
e18457d640edde2ec7adf7adbae9d4cc6d3fd4774f9d4d69c9b7d3a5c34fdb6e.exe
Resource
win10v2004-20220722-en
Malware Config
Targets
-
-
Target
e18457d640edde2ec7adf7adbae9d4cc6d3fd4774f9d4d69c9b7d3a5c34fdb6e
-
Size
6.5MB
-
MD5
1090fff2e77ef8af4bdad1a4247d98e8
-
SHA1
e03bc98212c50d408b357a62150baaed89d7d5bd
-
SHA256
e18457d640edde2ec7adf7adbae9d4cc6d3fd4774f9d4d69c9b7d3a5c34fdb6e
-
SHA512
71d42ddfb6e59b4e775465bc08bcbadc02fb62b57dc2b079ff7b9b09ea9b252697c86ab0e44c4aadc6e504866cdb199d9806a3837940b05ff771456c8ea03b66
-
Glupteba payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-