General
-
Target
9535b56f4973b09e6ab86ccdc23e9736834820f3bd726b44a76a0fd8aac1e45a
-
Size
4.2MB
-
Sample
240420-ssjwjsca6z
-
MD5
92740583eb800430b135668e08c20d78
-
SHA1
55f03676aa01c120cb74370168d0d024b186838d
-
SHA256
9535b56f4973b09e6ab86ccdc23e9736834820f3bd726b44a76a0fd8aac1e45a
-
SHA512
5dafd5e8d421fdf426a2f256efc4f1427a92600308ccddc7731b987560ea0c8023d61868f557fd6d186a85c9ecad60f7b07ebbc567550ada042caa1869f99f92
-
SSDEEP
49152:ZKOdvREmi8iTwPpeYBnAu4QJI7RESGN2UNQnUyHdr+bW0USBgrsqhT/DWSjgq2S0:QOLEfT6eYBhfhWV+b2vbWNq2SbuhR5
Static task
static1
Behavioral task
behavioral1
Sample
9535b56f4973b09e6ab86ccdc23e9736834820f3bd726b44a76a0fd8aac1e45a.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
9535b56f4973b09e6ab86ccdc23e9736834820f3bd726b44a76a0fd8aac1e45a
-
Size
4.2MB
-
MD5
92740583eb800430b135668e08c20d78
-
SHA1
55f03676aa01c120cb74370168d0d024b186838d
-
SHA256
9535b56f4973b09e6ab86ccdc23e9736834820f3bd726b44a76a0fd8aac1e45a
-
SHA512
5dafd5e8d421fdf426a2f256efc4f1427a92600308ccddc7731b987560ea0c8023d61868f557fd6d186a85c9ecad60f7b07ebbc567550ada042caa1869f99f92
-
SSDEEP
49152:ZKOdvREmi8iTwPpeYBnAu4QJI7RESGN2UNQnUyHdr+bW0USBgrsqhT/DWSjgq2S0:QOLEfT6eYBhfhWV+b2vbWNq2SbuhR5
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1