General
-
Target
3de22e3657bbbdba6317bb9ec8aa6d5ff045f973272f2fa00ffe3bde663ec444
-
Size
4.2MB
-
Sample
240417-s2wlpsff6x
-
MD5
3cb27e56511c53ace94d13cb97a245ef
-
SHA1
a36cf96e38d2f5f75d6c4d229e712bf594d98fb4
-
SHA256
3de22e3657bbbdba6317bb9ec8aa6d5ff045f973272f2fa00ffe3bde663ec444
-
SHA512
e4350c21360bcd184b94a6cde5e0975b624145c701dd9caf396c6f6be1385407a713b9dbd5f0e0c2b7e2e9e0b840ae15fec699168980f0022f58286c9b6a7176
-
SSDEEP
98304:TLVbjn5QXbYqWv3ncm0WhzzpB76eQWY7QAp:TRxMbhu1zzpBZQWY7QAp
Static task
static1
Behavioral task
behavioral1
Sample
3de22e3657bbbdba6317bb9ec8aa6d5ff045f973272f2fa00ffe3bde663ec444.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
3de22e3657bbbdba6317bb9ec8aa6d5ff045f973272f2fa00ffe3bde663ec444
-
Size
4.2MB
-
MD5
3cb27e56511c53ace94d13cb97a245ef
-
SHA1
a36cf96e38d2f5f75d6c4d229e712bf594d98fb4
-
SHA256
3de22e3657bbbdba6317bb9ec8aa6d5ff045f973272f2fa00ffe3bde663ec444
-
SHA512
e4350c21360bcd184b94a6cde5e0975b624145c701dd9caf396c6f6be1385407a713b9dbd5f0e0c2b7e2e9e0b840ae15fec699168980f0022f58286c9b6a7176
-
SSDEEP
98304:TLVbjn5QXbYqWv3ncm0WhzzpB76eQWY7QAp:TRxMbhu1zzpBZQWY7QAp
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1