General
-
Target
e277e9f15664d74ff041442d63529322bcf143ad87d36ab2aed1b84984054424
-
Size
3.9MB
-
Sample
230129-w6lh3sad7v
-
MD5
3fe78f7695077a15ff90b11c0793c21f
-
SHA1
2fcbb4d51326ca0eafafad8ce757f6855f34ec55
-
SHA256
e277e9f15664d74ff041442d63529322bcf143ad87d36ab2aed1b84984054424
-
SHA512
1f5a3e19576db656ceea0468989d308831fa384ac13434d15642787806f7d838cbe95072dbd8c3e73947d320e5f98e40f920a6f496ce297287d60bb865f2c141
-
SSDEEP
98304:/aYFMnyHD6WfIo6j5+xufrLgJ5PI8yJRX7r4fhNdP:3FOyHJm2SLglyJRr0J
Static task
static1
Behavioral task
behavioral1
Sample
e277e9f15664d74ff041442d63529322bcf143ad87d36ab2aed1b84984054424.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e277e9f15664d74ff041442d63529322bcf143ad87d36ab2aed1b84984054424.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
metasploit
windows/single_exec
Targets
-
-
Target
e277e9f15664d74ff041442d63529322bcf143ad87d36ab2aed1b84984054424
-
Size
3.9MB
-
MD5
3fe78f7695077a15ff90b11c0793c21f
-
SHA1
2fcbb4d51326ca0eafafad8ce757f6855f34ec55
-
SHA256
e277e9f15664d74ff041442d63529322bcf143ad87d36ab2aed1b84984054424
-
SHA512
1f5a3e19576db656ceea0468989d308831fa384ac13434d15642787806f7d838cbe95072dbd8c3e73947d320e5f98e40f920a6f496ce297287d60bb865f2c141
-
SSDEEP
98304:/aYFMnyHD6WfIo6j5+xufrLgJ5PI8yJRX7r4fhNdP:3FOyHJm2SLglyJRr0J
-
Glupteba payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
-