General
-
Target
63ce7e2a7f6c57e6fe2e118f5778f61c6a5e9d49474b56a2b994524639c72e43
-
Size
4.2MB
-
Sample
240419-17442agh87
-
MD5
1765eea0ab2534803ef6c66bc577050e
-
SHA1
125c83448ae731cae23bf610c10442c6f65142f2
-
SHA256
63ce7e2a7f6c57e6fe2e118f5778f61c6a5e9d49474b56a2b994524639c72e43
-
SHA512
f7d6c60c886d6b3683cfaec2bdf7fde5027dd9bb80de59266a758262eebbf8f102ecdd73448841813e446c79c780a3401e24196cbd332d5c66fa99fcd376ace1
-
SSDEEP
98304:8U3hL1ts8dbSY9vNf0GiZt5Zc1goZjyjpOQ2UuV2d5K67AFdMy:NxL1dd9NNfxiZt5CKGmjpOQTQe7Dy
Static task
static1
Behavioral task
behavioral1
Sample
63ce7e2a7f6c57e6fe2e118f5778f61c6a5e9d49474b56a2b994524639c72e43.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
63ce7e2a7f6c57e6fe2e118f5778f61c6a5e9d49474b56a2b994524639c72e43
-
Size
4.2MB
-
MD5
1765eea0ab2534803ef6c66bc577050e
-
SHA1
125c83448ae731cae23bf610c10442c6f65142f2
-
SHA256
63ce7e2a7f6c57e6fe2e118f5778f61c6a5e9d49474b56a2b994524639c72e43
-
SHA512
f7d6c60c886d6b3683cfaec2bdf7fde5027dd9bb80de59266a758262eebbf8f102ecdd73448841813e446c79c780a3401e24196cbd332d5c66fa99fcd376ace1
-
SSDEEP
98304:8U3hL1ts8dbSY9vNf0GiZt5Zc1goZjyjpOQ2UuV2d5K67AFdMy:NxL1dd9NNfxiZt5CKGmjpOQTQe7Dy
-
Glupteba payload
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables referencing many varying, potentially fake Windows User-Agents
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1