General
-
Target
204e26ba38c4c72ba3ba4f1e8d2a8cba129c56d78065c583c28c25637e46a6a3
-
Size
4.2MB
-
Sample
240426-w33yysad6t
-
MD5
c39ce739138d8c7ef8b143bdb084bfdb
-
SHA1
42912e3a8fc0198881e49ff80c3dd3bff245675d
-
SHA256
204e26ba38c4c72ba3ba4f1e8d2a8cba129c56d78065c583c28c25637e46a6a3
-
SHA512
155a98cd381d10255bfb56eba67bf5ad0cf6ae137349a12fd2fe7aa2a4b361d7c9d9ecfd81b6542f9ad826c49c39cadeba79d33f661b2dca12c3ffda18ff35e9
-
SSDEEP
98304:12LBAEOKvJ0/zY80N0vVppdLThkoJY3pu9gQ6ORc3/EM9CU8vMep:ctADCJ0L4N0vbpdLThJY3KtRc6k4
Static task
static1
Behavioral task
behavioral1
Sample
204e26ba38c4c72ba3ba4f1e8d2a8cba129c56d78065c583c28c25637e46a6a3.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
204e26ba38c4c72ba3ba4f1e8d2a8cba129c56d78065c583c28c25637e46a6a3
-
Size
4.2MB
-
MD5
c39ce739138d8c7ef8b143bdb084bfdb
-
SHA1
42912e3a8fc0198881e49ff80c3dd3bff245675d
-
SHA256
204e26ba38c4c72ba3ba4f1e8d2a8cba129c56d78065c583c28c25637e46a6a3
-
SHA512
155a98cd381d10255bfb56eba67bf5ad0cf6ae137349a12fd2fe7aa2a4b361d7c9d9ecfd81b6542f9ad826c49c39cadeba79d33f661b2dca12c3ffda18ff35e9
-
SSDEEP
98304:12LBAEOKvJ0/zY80N0vVppdLThkoJY3pu9gQ6ORc3/EM9CU8vMep:ctADCJ0L4N0vbpdLThJY3KtRc6k4
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1