General
-
Target
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f
-
Size
4.2MB
-
Sample
240420-sj77sabc46
-
MD5
646a9692051aa31062443ab79201abfc
-
SHA1
298de1c5af8c71d452824c4db0da1ef3c214f035
-
SHA256
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f
-
SHA512
5ca688550dbe12026dc1bb2a02edee4485ed7d9e8db3f7695783b902e329fd368dd9938e5ba701725331fcfc82baae3d36d39117504094d8180124c9ceb6008e
-
SSDEEP
49152:RKOdvREmi8iTwPpeYBnAu4QJI7RESGN2UNQnUyHdr+bW0USBgrsqhT/DWSjgq2Sw:4OLEfT6eYBhfhWV+b2vbWNq2SbuhRp
Static task
static1
Behavioral task
behavioral1
Sample
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f
-
Size
4.2MB
-
MD5
646a9692051aa31062443ab79201abfc
-
SHA1
298de1c5af8c71d452824c4db0da1ef3c214f035
-
SHA256
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f
-
SHA512
5ca688550dbe12026dc1bb2a02edee4485ed7d9e8db3f7695783b902e329fd368dd9938e5ba701725331fcfc82baae3d36d39117504094d8180124c9ceb6008e
-
SSDEEP
49152:RKOdvREmi8iTwPpeYBnAu4QJI7RESGN2UNQnUyHdr+bW0USBgrsqhT/DWSjgq2Sw:4OLEfT6eYBhfhWV+b2vbWNq2SbuhRp
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1