General
-
Target
a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22
-
Size
4.2MB
-
Sample
240420-z6styaag5s
-
MD5
12c1251ddacc8c6651573aaae2a36711
-
SHA1
aa4a4fc95f24a847f33a0fcc22d318fe947929d0
-
SHA256
a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22
-
SHA512
e8e9723b210254504ae06f77ed86ff5c7da0ac1ba5134cb2ab99cd42b06744cdf2379835d5e8cbd413da69b1184a0d6297d29dc8393794d8959c5a2dc94f0a69
-
SSDEEP
98304:6B6TE4JDSTIitXqfSjBwF+v4rSSNjcdSqGUwT7RQU7OM:HTFmTI8qKjKFA4r+dAh7RQU1
Static task
static1
Behavioral task
behavioral1
Sample
a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22
-
Size
4.2MB
-
MD5
12c1251ddacc8c6651573aaae2a36711
-
SHA1
aa4a4fc95f24a847f33a0fcc22d318fe947929d0
-
SHA256
a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22
-
SHA512
e8e9723b210254504ae06f77ed86ff5c7da0ac1ba5134cb2ab99cd42b06744cdf2379835d5e8cbd413da69b1184a0d6297d29dc8393794d8959c5a2dc94f0a69
-
SSDEEP
98304:6B6TE4JDSTIitXqfSjBwF+v4rSSNjcdSqGUwT7RQU7OM:HTFmTI8qKjKFA4r+dAh7RQU1
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1