General
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe
-
Size
4.2MB
-
Sample
240413-kbvbyscd37
-
MD5
88c9cb2995c96df8d838a12ea9ce4dd0
-
SHA1
bd9036aafaf4bc173d3094eb37c52bef4b6d0b9e
-
SHA256
bfb49b198bec40507f48ae692234f001c7b0daf41c5efd93bbce37c3f9082e60
-
SHA512
aaf43c0182a621c6677f2f613ed31cd187849c89793d06f91326d39ac99178662daca987a8a03bcd7a2dcb6f10b8e61570b3d9c2d218e05a1194b2e1bd50eb7f
-
SSDEEP
98304:mxYk/Wd4gprCGADohyqBdv1Fi5ytzZrDpDNU:YnWmu2kBdS54nBNU
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe
Resource
win7-20240215-en
Malware Config
Targets
-
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.7447.7880.exe
-
Size
4.2MB
-
MD5
88c9cb2995c96df8d838a12ea9ce4dd0
-
SHA1
bd9036aafaf4bc173d3094eb37c52bef4b6d0b9e
-
SHA256
bfb49b198bec40507f48ae692234f001c7b0daf41c5efd93bbce37c3f9082e60
-
SHA512
aaf43c0182a621c6677f2f613ed31cd187849c89793d06f91326d39ac99178662daca987a8a03bcd7a2dcb6f10b8e61570b3d9c2d218e05a1194b2e1bd50eb7f
-
SSDEEP
98304:mxYk/Wd4gprCGADohyqBdv1Fi5ytzZrDpDNU:YnWmu2kBdS54nBNU
-
Glupteba payload
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1