General
-
Target
24e22690959c975561523ec9dd8255cc9367b3755d109bd4550a88e8a88ebf8c
-
Size
4.2MB
-
Sample
240419-yeg3padf46
-
MD5
a3bb61cff2149475014e8c285e48f2fb
-
SHA1
7baafc7f3b94c14d4a05a69cb9f2b151af2d541d
-
SHA256
24e22690959c975561523ec9dd8255cc9367b3755d109bd4550a88e8a88ebf8c
-
SHA512
ecf825f0338f9fa871c328dc10493d808ab9315fb75c736e4a54bf1e7302365312f10128635a2940b1402827e219b6a87ec07abe5fc2c6f16593a214a893785b
-
SSDEEP
98304:aChC/hFO80L+t/wLiRU21IjdLRD45lSQeb0Kza87aMx:dh+FA+Cifk45cQeb08aKak
Static task
static1
Behavioral task
behavioral1
Sample
24e22690959c975561523ec9dd8255cc9367b3755d109bd4550a88e8a88ebf8c.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
24e22690959c975561523ec9dd8255cc9367b3755d109bd4550a88e8a88ebf8c
-
Size
4.2MB
-
MD5
a3bb61cff2149475014e8c285e48f2fb
-
SHA1
7baafc7f3b94c14d4a05a69cb9f2b151af2d541d
-
SHA256
24e22690959c975561523ec9dd8255cc9367b3755d109bd4550a88e8a88ebf8c
-
SHA512
ecf825f0338f9fa871c328dc10493d808ab9315fb75c736e4a54bf1e7302365312f10128635a2940b1402827e219b6a87ec07abe5fc2c6f16593a214a893785b
-
SSDEEP
98304:aChC/hFO80L+t/wLiRU21IjdLRD45lSQeb0Kza87aMx:dh+FA+Cifk45cQeb08aKak
-
Glupteba payload
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables referencing many varying, potentially fake Windows User-Agents
-
UPX dump on OEP (original entry point)
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1