General
-
Target
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
-
Size
4.0MB
-
Sample
230129-tta6gade38
-
MD5
e006b2b08833a38314bad962b8e549eb
-
SHA1
289e9b527460258ce38402604b82ab1784b93229
-
SHA256
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
-
SHA512
2a4f4e47c909abfd6a59a38536b357d7ff84177094897ea2819fd87dfc07b239061395ce3fd5ffbbf14a2d709b34691f975adf598b7e89ee6b607289d0b87e03
-
SSDEEP
98304:rGCKnQtyq51ek1S7mP13ds372CfpMyc61mEy6Ti9Hvti2:rzKfS1ehmd3IZfpJc6HLTOHvp
Static task
static1
Behavioral task
behavioral1
Sample
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe
Resource
win7-20221111-en
Malware Config
Targets
-
-
Target
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
-
Size
4.0MB
-
MD5
e006b2b08833a38314bad962b8e549eb
-
SHA1
289e9b527460258ce38402604b82ab1784b93229
-
SHA256
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
-
SHA512
2a4f4e47c909abfd6a59a38536b357d7ff84177094897ea2819fd87dfc07b239061395ce3fd5ffbbf14a2d709b34691f975adf598b7e89ee6b607289d0b87e03
-
SSDEEP
98304:rGCKnQtyq51ek1S7mP13ds372CfpMyc61mEy6Ti9Hvti2:rzKfS1ehmd3IZfpJc6HLTOHvp
-
Glupteba payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-