General
-
Target
a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348
-
Size
4.1MB
-
Sample
240421-tw9rtafa52
-
MD5
b47fdaf06def2d9fdef7b418061f2a82
-
SHA1
7c42df27d750c81e5ac7a41fbe4e03cd8e059272
-
SHA256
a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348
-
SHA512
220ec67ad898b703357b6fc64aec02e1e950e3c0ee1dc9817e8af17eaa642a6c51194802a084c91bfbc6abb9905e626779af88fd441991262f6915c7769e9da3
-
SSDEEP
98304:8wAze/FNZMWTI4IerOgms7GjcZA7/RTa+EmUQAtQ:+S/DzMv1si4yTElQp
Static task
static1
Behavioral task
behavioral1
Sample
a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348
-
Size
4.1MB
-
MD5
b47fdaf06def2d9fdef7b418061f2a82
-
SHA1
7c42df27d750c81e5ac7a41fbe4e03cd8e059272
-
SHA256
a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348
-
SHA512
220ec67ad898b703357b6fc64aec02e1e950e3c0ee1dc9817e8af17eaa642a6c51194802a084c91bfbc6abb9905e626779af88fd441991262f6915c7769e9da3
-
SSDEEP
98304:8wAze/FNZMWTI4IerOgms7GjcZA7/RTa+EmUQAtQ:+S/DzMv1si4yTElQp
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1