General
-
Target
a9941174e6ef9377f35fc59067a11b68347774d10320e4fd98a4232b626b2cf7
-
Size
4.2MB
-
Sample
240426-3hmvkafc2x
-
MD5
ba6a1e5da1e8dffa9ce0e17aa5ef1acc
-
SHA1
562e17a3b8ac1d793d2181371d7c93b1ca3505ee
-
SHA256
a9941174e6ef9377f35fc59067a11b68347774d10320e4fd98a4232b626b2cf7
-
SHA512
950bba1578613b460c03d404a4b6beeef24df413faa910dda6fbec4805ead55b66d0ab2d1742e1bb861a61e3c36c087321eaa29fc113a7e1a3ccb2cab8462c78
-
SSDEEP
98304:uNqkCei/RpwTNwvC/d0zkTzoLKVJHo/KUEsELUhP0F0GS:uueAwA5oTznVGKlAco
Static task
static1
Behavioral task
behavioral1
Sample
a9941174e6ef9377f35fc59067a11b68347774d10320e4fd98a4232b626b2cf7.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
a9941174e6ef9377f35fc59067a11b68347774d10320e4fd98a4232b626b2cf7
-
Size
4.2MB
-
MD5
ba6a1e5da1e8dffa9ce0e17aa5ef1acc
-
SHA1
562e17a3b8ac1d793d2181371d7c93b1ca3505ee
-
SHA256
a9941174e6ef9377f35fc59067a11b68347774d10320e4fd98a4232b626b2cf7
-
SHA512
950bba1578613b460c03d404a4b6beeef24df413faa910dda6fbec4805ead55b66d0ab2d1742e1bb861a61e3c36c087321eaa29fc113a7e1a3ccb2cab8462c78
-
SSDEEP
98304:uNqkCei/RpwTNwvC/d0zkTzoLKVJHo/KUEsELUhP0F0GS:uueAwA5oTznVGKlAco
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1