General
-
Target
2aa28e1754da42339ddb4b6c98fe25200b62ca716209ab0d317fedba81e6fe0e
-
Size
4.2MB
-
Sample
240417-svl4pafd31
-
MD5
eee4a13e65d48d32a5531c0f08fd1202
-
SHA1
cfb2f29c3c1e39c11595414aa7791dfaa6b482cb
-
SHA256
2aa28e1754da42339ddb4b6c98fe25200b62ca716209ab0d317fedba81e6fe0e
-
SHA512
0ec8bab5efa99732f1271e22d80fb0bb9409b131b57fe6dd9b64433b2e88532214de24397198aae2f234c02bbb6dd15a97b2359bc946530c461571956bf3fa28
-
SSDEEP
98304:UwoxqRNHtYTbrnnqfLVkrWMdzx639PKF8QxO:PXR9tYTb7qxEbNx6NSxO
Static task
static1
Behavioral task
behavioral1
Sample
2aa28e1754da42339ddb4b6c98fe25200b62ca716209ab0d317fedba81e6fe0e.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
2aa28e1754da42339ddb4b6c98fe25200b62ca716209ab0d317fedba81e6fe0e
-
Size
4.2MB
-
MD5
eee4a13e65d48d32a5531c0f08fd1202
-
SHA1
cfb2f29c3c1e39c11595414aa7791dfaa6b482cb
-
SHA256
2aa28e1754da42339ddb4b6c98fe25200b62ca716209ab0d317fedba81e6fe0e
-
SHA512
0ec8bab5efa99732f1271e22d80fb0bb9409b131b57fe6dd9b64433b2e88532214de24397198aae2f234c02bbb6dd15a97b2359bc946530c461571956bf3fa28
-
SSDEEP
98304:UwoxqRNHtYTbrnnqfLVkrWMdzx639PKF8QxO:PXR9tYTb7qxEbNx6NSxO
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1