General
-
Target
56a666a7355764fbddeb9f0001e9783007427afa1e02871c09a02933031b2daa
-
Size
4.2MB
-
Sample
240420-kaaadscd77
-
MD5
d66428bd2063f2867be8269430359ad7
-
SHA1
e79c3167d749bd0c63207590fce64489f45a9a8b
-
SHA256
56a666a7355764fbddeb9f0001e9783007427afa1e02871c09a02933031b2daa
-
SHA512
bdd6c1a83cf3ad4b45f8d91a3d2ffd706ef9418a9027a990f3918c19a5e7371b516b47b0b2f24569ac0f9a9e949a49401f01f76afc4b8dd333b1bdcc620e7739
-
SSDEEP
98304:CS8Tc81AzKVcNOUNHF6RiNP154spKvDdhObEo7QvVY0ryRAf1Tp7ORp:zEcJzF4UNHqA/dsmoVS4YAf19q
Static task
static1
Behavioral task
behavioral1
Sample
56a666a7355764fbddeb9f0001e9783007427afa1e02871c09a02933031b2daa.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
56a666a7355764fbddeb9f0001e9783007427afa1e02871c09a02933031b2daa
-
Size
4.2MB
-
MD5
d66428bd2063f2867be8269430359ad7
-
SHA1
e79c3167d749bd0c63207590fce64489f45a9a8b
-
SHA256
56a666a7355764fbddeb9f0001e9783007427afa1e02871c09a02933031b2daa
-
SHA512
bdd6c1a83cf3ad4b45f8d91a3d2ffd706ef9418a9027a990f3918c19a5e7371b516b47b0b2f24569ac0f9a9e949a49401f01f76afc4b8dd333b1bdcc620e7739
-
SSDEEP
98304:CS8Tc81AzKVcNOUNHF6RiNP154spKvDdhObEo7QvVY0ryRAf1Tp7ORp:zEcJzF4UNHqA/dsmoVS4YAf19q
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1