General
-
Target
a75c9620c9fe19a2ddf2086dd7df26374b09f7c9005b51429bc6f6b11074a342
-
Size
4.2MB
-
Sample
240417-24qynsab8x
-
MD5
0654682efebc358cb5340d35bae206a8
-
SHA1
ac6c7a1a443b0597c2ccfed0f365251432fd1566
-
SHA256
a75c9620c9fe19a2ddf2086dd7df26374b09f7c9005b51429bc6f6b11074a342
-
SHA512
a465ab3c20a96e1762761dae368e5d9bc1035a43f193e4de11fa1cde70eabc2f38f505c66afc79ca3e2e6736a4a9703b898dc62eb13c5372e8cbcc60a6b7bee9
-
SSDEEP
98304:Vuj+q6TJ4wJXu5ZJ1j+7xTB8ercClYoKJ32fC3NV26E3wqtOnXcGdwYxx7:Ij+FTuwJ2ZmxTB8FOXbwqtOnFmYx7
Static task
static1
Behavioral task
behavioral1
Sample
a75c9620c9fe19a2ddf2086dd7df26374b09f7c9005b51429bc6f6b11074a342.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
a75c9620c9fe19a2ddf2086dd7df26374b09f7c9005b51429bc6f6b11074a342
-
Size
4.2MB
-
MD5
0654682efebc358cb5340d35bae206a8
-
SHA1
ac6c7a1a443b0597c2ccfed0f365251432fd1566
-
SHA256
a75c9620c9fe19a2ddf2086dd7df26374b09f7c9005b51429bc6f6b11074a342
-
SHA512
a465ab3c20a96e1762761dae368e5d9bc1035a43f193e4de11fa1cde70eabc2f38f505c66afc79ca3e2e6736a4a9703b898dc62eb13c5372e8cbcc60a6b7bee9
-
SSDEEP
98304:Vuj+q6TJ4wJXu5ZJ1j+7xTB8ercClYoKJ32fC3NV26E3wqtOnXcGdwYxx7:Ij+FTuwJ2ZmxTB8FOXbwqtOnFmYx7
-
Glupteba payload
-
Blocklisted process makes network request
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1