General
-
Target
9e52f61179a9f635cf93a2adcd344211eb663fc88099f53b5781750344e2a73d
-
Size
3.9MB
-
Sample
230129-w6s8xsad7y
-
MD5
aa9a74ed2d15de213de422c285ceb9e3
-
SHA1
efae901b38d21151530b653dca68093b2268fed6
-
SHA256
9e52f61179a9f635cf93a2adcd344211eb663fc88099f53b5781750344e2a73d
-
SHA512
04220cb114204ea0cac501bb070fc3c8b3dede3d246d872e3972a56f26382ccbfbc4dc4ad8b920863550789c48c9203bda59117db9a747cdb4a596cf94e78876
-
SSDEEP
98304:YyGJATgl3Fl9sghdW4leX1K/MTTuetBIZjtCTmj:YykOgbl9sghU444EJtBIZyM
Static task
static1
Behavioral task
behavioral1
Sample
9e52f61179a9f635cf93a2adcd344211eb663fc88099f53b5781750344e2a73d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9e52f61179a9f635cf93a2adcd344211eb663fc88099f53b5781750344e2a73d.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
metasploit
windows/single_exec
Targets
-
-
Target
9e52f61179a9f635cf93a2adcd344211eb663fc88099f53b5781750344e2a73d
-
Size
3.9MB
-
MD5
aa9a74ed2d15de213de422c285ceb9e3
-
SHA1
efae901b38d21151530b653dca68093b2268fed6
-
SHA256
9e52f61179a9f635cf93a2adcd344211eb663fc88099f53b5781750344e2a73d
-
SHA512
04220cb114204ea0cac501bb070fc3c8b3dede3d246d872e3972a56f26382ccbfbc4dc4ad8b920863550789c48c9203bda59117db9a747cdb4a596cf94e78876
-
SSDEEP
98304:YyGJATgl3Fl9sghdW4leX1K/MTTuetBIZjtCTmj:YykOgbl9sghU444EJtBIZyM
-
Glupteba payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-