General
-
Target
53a236823792eb5298247b0d7fb5080e200e721993be81b59c4faef90e99468c
-
Size
4.2MB
-
Sample
240426-y8ceasbe65
-
MD5
9590c0e7d5a44d31f0b6dc0a3b03a5b0
-
SHA1
f85c67873bcc6467a1e94adf7680c01bd3781e88
-
SHA256
53a236823792eb5298247b0d7fb5080e200e721993be81b59c4faef90e99468c
-
SHA512
52f2003f33f7db8e147207f2a29d73627ef6b40ab90ff0bcf871f9ca4b7ce971f292d0e4e8fd78d49564fe4283264d4a700755348bc09ea775ab81a9a15e6b39
-
SSDEEP
98304:q2m5eOYCD1ID98VF2Kih+6YxfniOeVNR3JpIP6GA7sf3HgV11G9:q2m5BYCDY8uVjYxfniXVNFJ2yR7sfQVU
Static task
static1
Behavioral task
behavioral1
Sample
53a236823792eb5298247b0d7fb5080e200e721993be81b59c4faef90e99468c.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
53a236823792eb5298247b0d7fb5080e200e721993be81b59c4faef90e99468c
-
Size
4.2MB
-
MD5
9590c0e7d5a44d31f0b6dc0a3b03a5b0
-
SHA1
f85c67873bcc6467a1e94adf7680c01bd3781e88
-
SHA256
53a236823792eb5298247b0d7fb5080e200e721993be81b59c4faef90e99468c
-
SHA512
52f2003f33f7db8e147207f2a29d73627ef6b40ab90ff0bcf871f9ca4b7ce971f292d0e4e8fd78d49564fe4283264d4a700755348bc09ea775ab81a9a15e6b39
-
SSDEEP
98304:q2m5eOYCD1ID98VF2Kih+6YxfniOeVNR3JpIP6GA7sf3HgV11G9:q2m5BYCDY8uVjYxfniXVNFJ2yR7sfQVU
-
Glupteba payload
-
Blocklisted process makes network request
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1