General
-
Target
535660abe2d68460b6c85ea61b1664c849746b4b9705b9d6bbe8988fac217315
-
Size
4.2MB
-
Sample
240418-2kscdshh3y
-
MD5
03a21809d83e0e195231b0c3ca9e437e
-
SHA1
ee0eba108107044e7f5d55dba7e2ed8eed1975a0
-
SHA256
535660abe2d68460b6c85ea61b1664c849746b4b9705b9d6bbe8988fac217315
-
SHA512
95cde5aa17abd96b07099e8a07e3c7e535d99e7933f1f4cf284c8275c0e1ee9a454ceceb29e7000217961cde48a22aab6a11a882406e19c97d328d934a179439
-
SSDEEP
98304:WtjN4XUN5lD056p7XAm0hR9X9T5AEVb4a7iAHgos518N4:7RATQPX9T5A6hiAH2518q
Static task
static1
Behavioral task
behavioral1
Sample
535660abe2d68460b6c85ea61b1664c849746b4b9705b9d6bbe8988fac217315.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
535660abe2d68460b6c85ea61b1664c849746b4b9705b9d6bbe8988fac217315
-
Size
4.2MB
-
MD5
03a21809d83e0e195231b0c3ca9e437e
-
SHA1
ee0eba108107044e7f5d55dba7e2ed8eed1975a0
-
SHA256
535660abe2d68460b6c85ea61b1664c849746b4b9705b9d6bbe8988fac217315
-
SHA512
95cde5aa17abd96b07099e8a07e3c7e535d99e7933f1f4cf284c8275c0e1ee9a454ceceb29e7000217961cde48a22aab6a11a882406e19c97d328d934a179439
-
SSDEEP
98304:WtjN4XUN5lD056p7XAm0hR9X9T5AEVb4a7iAHgos518N4:7RATQPX9T5A6hiAH2518q
-
Glupteba payload
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1