General
-
Target
eeaeda4675cfb552f8be5387f6b10b527017bf8a76bce34d8b0fdd631bd32bcb
-
Size
4.2MB
-
Sample
240420-tmgpnscc84
-
MD5
389c0a78675c61549372368b2650b715
-
SHA1
a6fad5d4d0cf7949a8bc2a57d655968bb77aa0d9
-
SHA256
eeaeda4675cfb552f8be5387f6b10b527017bf8a76bce34d8b0fdd631bd32bcb
-
SHA512
ecfab749f687a774c766634a1af432a769a232de86337c2c7c418506923978d20a9cd229cdc8e1ec869d86dc02fb66182d1fd978a66affbfa268c731ca770318
-
SSDEEP
49152:Ar1oHj0tlV0f9s8MWzX04BUpcYbKwdRAyQZQ93cNVdRbmMzimZc5ZnjMAqqwRi8X:ABcwtA9b44emOBqNRUORBLE4Ajzs
Static task
static1
Behavioral task
behavioral1
Sample
eeaeda4675cfb552f8be5387f6b10b527017bf8a76bce34d8b0fdd631bd32bcb.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
eeaeda4675cfb552f8be5387f6b10b527017bf8a76bce34d8b0fdd631bd32bcb
-
Size
4.2MB
-
MD5
389c0a78675c61549372368b2650b715
-
SHA1
a6fad5d4d0cf7949a8bc2a57d655968bb77aa0d9
-
SHA256
eeaeda4675cfb552f8be5387f6b10b527017bf8a76bce34d8b0fdd631bd32bcb
-
SHA512
ecfab749f687a774c766634a1af432a769a232de86337c2c7c418506923978d20a9cd229cdc8e1ec869d86dc02fb66182d1fd978a66affbfa268c731ca770318
-
SSDEEP
49152:Ar1oHj0tlV0f9s8MWzX04BUpcYbKwdRAyQZQ93cNVdRbmMzimZc5ZnjMAqqwRi8X:ABcwtA9b44emOBqNRUORBLE4Ajzs
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1