General
-
Target
434d945b2fb3c2fe6a745adb2171d58dcb68aeb36a21de73c2b8a6c15ed9e57d
-
Size
4.1MB
-
Sample
230328-lpx6faac27
-
MD5
05c46119bec55371c8e74703c0b16549
-
SHA1
a2591f3f932157cc827f17fbe29da16747eb0b5c
-
SHA256
434d945b2fb3c2fe6a745adb2171d58dcb68aeb36a21de73c2b8a6c15ed9e57d
-
SHA512
3daf23b3b98a0a18e2e55b1f1fbf6728ad573f782e45fd626da4e4584b8c9a97802b000373332199aeb9131830d0b6bd772774a45a48b8f02c6bc39aa9646e2f
-
SSDEEP
98304:Ayh1jETwblZHBMNSSg7jKCQXGyLLsWJ3FPCckKmv3C8niJQd:1tbD75Q2yLLswFPCckKiiU
Static task
static1
Malware Config
Targets
-
-
Target
434d945b2fb3c2fe6a745adb2171d58dcb68aeb36a21de73c2b8a6c15ed9e57d
-
Size
4.1MB
-
MD5
05c46119bec55371c8e74703c0b16549
-
SHA1
a2591f3f932157cc827f17fbe29da16747eb0b5c
-
SHA256
434d945b2fb3c2fe6a745adb2171d58dcb68aeb36a21de73c2b8a6c15ed9e57d
-
SHA512
3daf23b3b98a0a18e2e55b1f1fbf6728ad573f782e45fd626da4e4584b8c9a97802b000373332199aeb9131830d0b6bd772774a45a48b8f02c6bc39aa9646e2f
-
SSDEEP
98304:Ayh1jETwblZHBMNSSg7jKCQXGyLLsWJ3FPCckKmv3C8niJQd:1tbD75Q2yLLswFPCckKiiU
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-