General
-
Target
a3f3b86b629eea6d88d62641b94d6b6a2d49d16ee85ec2a6710ea7a5fadb10f3
-
Size
4.1MB
-
Sample
230327-mqeadsfb41
-
MD5
a46e627b6a82dc325860fecf504aa90f
-
SHA1
b4e7cd7d2c4b2f3dba28520d9d99ee7b342a2872
-
SHA256
a3f3b86b629eea6d88d62641b94d6b6a2d49d16ee85ec2a6710ea7a5fadb10f3
-
SHA512
cd7535615b1718e5cbd3e519590c0214d04874613cf69c6551eb4856a8cbad1c6197e967ee29d12b8a9b6af006c1448151de61c4b1fafac71d6a662bdba77399
-
SSDEEP
98304:qlUsq5/mFUy5W3l9xAhU+wp3o0ideZIOvfviQrMRto/4Sxf:aUB/mFUy5W3l8hM3oN4ZIbQrMRtsf
Static task
static1
Malware Config
Targets
-
-
Target
a3f3b86b629eea6d88d62641b94d6b6a2d49d16ee85ec2a6710ea7a5fadb10f3
-
Size
4.1MB
-
MD5
a46e627b6a82dc325860fecf504aa90f
-
SHA1
b4e7cd7d2c4b2f3dba28520d9d99ee7b342a2872
-
SHA256
a3f3b86b629eea6d88d62641b94d6b6a2d49d16ee85ec2a6710ea7a5fadb10f3
-
SHA512
cd7535615b1718e5cbd3e519590c0214d04874613cf69c6551eb4856a8cbad1c6197e967ee29d12b8a9b6af006c1448151de61c4b1fafac71d6a662bdba77399
-
SSDEEP
98304:qlUsq5/mFUy5W3l9xAhU+wp3o0ideZIOvfviQrMRto/4Sxf:aUB/mFUy5W3l8hM3oN4ZIbQrMRtsf
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-