General
-
Target
73f94ad9f207c6032937c69006b22fde4cf7d6c766305746ee32c9f2d28a5e4e
-
Size
4.2MB
-
Sample
240419-th496sge93
-
MD5
2a053c6db1b8da8221b643d2fa002d56
-
SHA1
5d4a0d2102b00985cdaed1e64e31d8b894c4d369
-
SHA256
73f94ad9f207c6032937c69006b22fde4cf7d6c766305746ee32c9f2d28a5e4e
-
SHA512
bb7cab3a06678a1c55696a1c1fe8d318dcc6207edc9a0da105b3c4d1b1c9ca459e5b388d554af59c40f68505bcc28ce11063f627f88d6cbf98d20d736fc9fae4
-
SSDEEP
98304:noZCtMNcIJm/Wi5iI7vKblq/qDx6472PxO1xv/KiJet:n3OuIEug7vwUGt7S+nKf
Static task
static1
Behavioral task
behavioral1
Sample
73f94ad9f207c6032937c69006b22fde4cf7d6c766305746ee32c9f2d28a5e4e.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
73f94ad9f207c6032937c69006b22fde4cf7d6c766305746ee32c9f2d28a5e4e
-
Size
4.2MB
-
MD5
2a053c6db1b8da8221b643d2fa002d56
-
SHA1
5d4a0d2102b00985cdaed1e64e31d8b894c4d369
-
SHA256
73f94ad9f207c6032937c69006b22fde4cf7d6c766305746ee32c9f2d28a5e4e
-
SHA512
bb7cab3a06678a1c55696a1c1fe8d318dcc6207edc9a0da105b3c4d1b1c9ca459e5b388d554af59c40f68505bcc28ce11063f627f88d6cbf98d20d736fc9fae4
-
SSDEEP
98304:noZCtMNcIJm/Wi5iI7vKblq/qDx6472PxO1xv/KiJet:n3OuIEug7vwUGt7S+nKf
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1