General
-
Target
03972599.exe
-
Size
4.2MB
-
Sample
230607-paj7taaf2y
-
MD5
3d2a6ba9e5e78df22e097a4a368ac732
-
SHA1
fbc90fb673740a574ad25f199c6cb864ff4cd159
-
SHA256
87d551f87d6578c4e385493cdfcce666c65947f53d502ef5c557f446d802506d
-
SHA512
0638bf96f090e9d07252a8994eac383f127da2e6c48754eb6b92748babc8db1325f3a85e52f5ec08fc8f28125dd3480813e10b01ef6af01a95b8539261254355
-
SSDEEP
98304:17cjpnWTod4g2pxfbBxBg9mIiQMFSS/eeWhB:l4pnQn9xB8w/epz
Static task
static1
Behavioral task
behavioral1
Sample
03972599.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
03972599.exe
-
Size
4.2MB
-
MD5
3d2a6ba9e5e78df22e097a4a368ac732
-
SHA1
fbc90fb673740a574ad25f199c6cb864ff4cd159
-
SHA256
87d551f87d6578c4e385493cdfcce666c65947f53d502ef5c557f446d802506d
-
SHA512
0638bf96f090e9d07252a8994eac383f127da2e6c48754eb6b92748babc8db1325f3a85e52f5ec08fc8f28125dd3480813e10b01ef6af01a95b8539261254355
-
SSDEEP
98304:17cjpnWTod4g2pxfbBxBg9mIiQMFSS/eeWhB:l4pnQn9xB8w/epz
-
Glupteba payload
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-