General
-
Target
634f517c5ff3efa8859c46ffbabdd9bf2f7da55f179dffcc683535c6025b4a76
-
Size
4.2MB
-
Sample
240420-j8fpdsda7w
-
MD5
e5ed53e808841eaa61cda1453ba1bb9c
-
SHA1
76759ba6b4cc525c40de7464d0464514ce997217
-
SHA256
634f517c5ff3efa8859c46ffbabdd9bf2f7da55f179dffcc683535c6025b4a76
-
SHA512
8a71f48d9731f49089ea923f48cf68517fa48e3601d9fd97ab48d12a3bdd39e0b08c43c5534bb7eb8913a4231a6646d2cc47cec979ab0a7f4abf438f77cdafc1
-
SSDEEP
98304:qS8Tc81AzKVcNOUNHF6RiNP154spKvDdhObEo7QvVY0ryRAf1Tp7ORe:rEcJzF4UNHqA/dsmoVS4YAf19B
Static task
static1
Behavioral task
behavioral1
Sample
634f517c5ff3efa8859c46ffbabdd9bf2f7da55f179dffcc683535c6025b4a76.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
634f517c5ff3efa8859c46ffbabdd9bf2f7da55f179dffcc683535c6025b4a76
-
Size
4.2MB
-
MD5
e5ed53e808841eaa61cda1453ba1bb9c
-
SHA1
76759ba6b4cc525c40de7464d0464514ce997217
-
SHA256
634f517c5ff3efa8859c46ffbabdd9bf2f7da55f179dffcc683535c6025b4a76
-
SHA512
8a71f48d9731f49089ea923f48cf68517fa48e3601d9fd97ab48d12a3bdd39e0b08c43c5534bb7eb8913a4231a6646d2cc47cec979ab0a7f4abf438f77cdafc1
-
SSDEEP
98304:qS8Tc81AzKVcNOUNHF6RiNP154spKvDdhObEo7QvVY0ryRAf1Tp7ORe:rEcJzF4UNHqA/dsmoVS4YAf19B
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1