General
-
Target
8326890d71d13a36ad5f4d2d144045b747bad5d00f974415ed8ff88b858194e7
-
Size
4.1MB
-
Sample
240516-sr2d7sag4y
-
MD5
c3c2dd27495e2493df38fd487e98dd35
-
SHA1
e59486f19f71400d37dd6dd75a94e1790552891a
-
SHA256
8326890d71d13a36ad5f4d2d144045b747bad5d00f974415ed8ff88b858194e7
-
SHA512
681f96542d73bb52caea1870b01c0a9b191324a3d7ea910dd01d07363e34151d64a1cc497f7da1da17182f971600b19c64531ae8c1d87384276a62404ee74f6c
-
SSDEEP
98304:QvzBhIm6zIE7SIO2RhCG9zRnSMmyRgCXxFQG9c/:mzBhDcIv8bCGbNmyXXxFQGy/
Static task
static1
Behavioral task
behavioral1
Sample
8326890d71d13a36ad5f4d2d144045b747bad5d00f974415ed8ff88b858194e7.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
8326890d71d13a36ad5f4d2d144045b747bad5d00f974415ed8ff88b858194e7
-
Size
4.1MB
-
MD5
c3c2dd27495e2493df38fd487e98dd35
-
SHA1
e59486f19f71400d37dd6dd75a94e1790552891a
-
SHA256
8326890d71d13a36ad5f4d2d144045b747bad5d00f974415ed8ff88b858194e7
-
SHA512
681f96542d73bb52caea1870b01c0a9b191324a3d7ea910dd01d07363e34151d64a1cc497f7da1da17182f971600b19c64531ae8c1d87384276a62404ee74f6c
-
SSDEEP
98304:QvzBhIm6zIE7SIO2RhCG9zRnSMmyRgCXxFQG9c/:mzBhDcIv8bCGbNmyXXxFQGy/
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1