General
-
Target
9af88cfdb1a10ef65262363d34d063007ad9355306701632fce58861ed419219
-
Size
4.2MB
-
Sample
240420-sgw2qsbb86
-
MD5
0896e07831d0a8e21202a1ea3f005adf
-
SHA1
5b701dffaae64691915146f11267de6d33c4f312
-
SHA256
9af88cfdb1a10ef65262363d34d063007ad9355306701632fce58861ed419219
-
SHA512
8dbceaeb5b7da96a6e0fbe9a3f8ff6ea512cc6a72ee50cf797b7c6b93684fd643c7971e3d9349c145f26c8690314fe4f79eea117772d3e916ed262162685a4f8
-
SSDEEP
49152:JKOdvREmi8iTwPpeYBnAu4QJI7RESGN2UNQnUyHdr+bW0USBgrsqhT/DWSjgq2Sl:AOLEfT6eYBhfhWV+b2vbWNq2SbuhRk
Static task
static1
Behavioral task
behavioral1
Sample
9af88cfdb1a10ef65262363d34d063007ad9355306701632fce58861ed419219.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
9af88cfdb1a10ef65262363d34d063007ad9355306701632fce58861ed419219
-
Size
4.2MB
-
MD5
0896e07831d0a8e21202a1ea3f005adf
-
SHA1
5b701dffaae64691915146f11267de6d33c4f312
-
SHA256
9af88cfdb1a10ef65262363d34d063007ad9355306701632fce58861ed419219
-
SHA512
8dbceaeb5b7da96a6e0fbe9a3f8ff6ea512cc6a72ee50cf797b7c6b93684fd643c7971e3d9349c145f26c8690314fe4f79eea117772d3e916ed262162685a4f8
-
SSDEEP
49152:JKOdvREmi8iTwPpeYBnAu4QJI7RESGN2UNQnUyHdr+bW0USBgrsqhT/DWSjgq2Sl:AOLEfT6eYBhfhWV+b2vbWNq2SbuhRk
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1