General
-
Target
2258a6dc012ad906d2f915a58e887443d4fceeb1c1e0d5d1c04069a90ed39ae2
-
Size
4.1MB
-
Sample
240421-zjenssbe3x
-
MD5
112eaf84758a0646f72b0a16d73de57a
-
SHA1
c21492e8c798a2ae44dcdea4344fc2800095ca65
-
SHA256
2258a6dc012ad906d2f915a58e887443d4fceeb1c1e0d5d1c04069a90ed39ae2
-
SHA512
a001eaca3ab11a7fe90b3a34d480add6149f0ae160a1499482685fa57d6445fedb07aca41c262d3327b7060b97662edae8d73f11bf88c8d717f712f94f39df02
-
SSDEEP
98304:wwsyYpLI30hNm0X97sfQhuFOzbEeYixTYaktM3XAOoYGnm0lEA:2llzc0tsfv+41ixUfgAfRVr
Static task
static1
Behavioral task
behavioral1
Sample
2258a6dc012ad906d2f915a58e887443d4fceeb1c1e0d5d1c04069a90ed39ae2.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
2258a6dc012ad906d2f915a58e887443d4fceeb1c1e0d5d1c04069a90ed39ae2
-
Size
4.1MB
-
MD5
112eaf84758a0646f72b0a16d73de57a
-
SHA1
c21492e8c798a2ae44dcdea4344fc2800095ca65
-
SHA256
2258a6dc012ad906d2f915a58e887443d4fceeb1c1e0d5d1c04069a90ed39ae2
-
SHA512
a001eaca3ab11a7fe90b3a34d480add6149f0ae160a1499482685fa57d6445fedb07aca41c262d3327b7060b97662edae8d73f11bf88c8d717f712f94f39df02
-
SSDEEP
98304:wwsyYpLI30hNm0X97sfQhuFOzbEeYixTYaktM3XAOoYGnm0lEA:2llzc0tsfv+41ixUfgAfRVr
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1