General
-
Target
73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41
-
Size
4.2MB
-
Sample
240420-nwhqfagd5t
-
MD5
ab1ada7b0944f65ed0bdb3512c655f83
-
SHA1
7a1a23ec95931672d4d75bc0a9f73a9e68cd938f
-
SHA256
73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41
-
SHA512
2c845cb505b6633b6ec6e5906f490b06b17b7c63562b31a973845a2810dd19257acedbf9d4aea4cc510fb1a8b3c70ceefaa9c0a116f0a561e2bd9a246673ca53
-
SSDEEP
98304:CExeyMsyixS5pRc4vIUtzCuveHCg7xBa+u+nRp:CMby0Sruak17xws
Static task
static1
Behavioral task
behavioral1
Sample
73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41
-
Size
4.2MB
-
MD5
ab1ada7b0944f65ed0bdb3512c655f83
-
SHA1
7a1a23ec95931672d4d75bc0a9f73a9e68cd938f
-
SHA256
73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41
-
SHA512
2c845cb505b6633b6ec6e5906f490b06b17b7c63562b31a973845a2810dd19257acedbf9d4aea4cc510fb1a8b3c70ceefaa9c0a116f0a561e2bd9a246673ca53
-
SSDEEP
98304:CExeyMsyixS5pRc4vIUtzCuveHCg7xBa+u+nRp:CMby0Sruak17xws
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1