Behavioral task
behavioral1
Sample
2260-171-0x0000000000400000-0x0000000000D41000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2260-171-0x0000000000400000-0x0000000000D41000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
2260-171-0x0000000000400000-0x0000000000D41000-memory.dmp
-
Size
7.7MB
-
MD5
e5e07e436e57cceb4822f6bae5e91b87
-
SHA1
e0b54576a834fe5b0872adb0d54131ffd38d2d43
-
SHA256
778ff23eacfdf47df47a4db597d42d02aaf0105b85255500f3d93a62e0122b93
-
SHA512
608912402685126627c49082b0da20e852d91fc2308bc02c8c577d70a9195da7dd5377599ba8d91b129a0b76953260f14b9ea852f2f6c69130181c186ecbbc79
-
SSDEEP
98304:rAepitsWVwUQtDxLq+na0lx/XxMLvhhZytTVhg5T:rAGitpzSxMLphwVhGT
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba family
-
Glupteba payload 1 IoCs
Processes:
resource yara_rule sample family_glupteba -
Metasploit family
Files
-
2260-171-0x0000000000400000-0x0000000000D41000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.2MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ