General

  • Target

    e76f20c61fd3a8c306a2e4901d864033df9a3bbde6d06420ebabaf13340d1311

  • Size

    5.0MB

  • Sample

    220521-msb8tafebl

  • MD5

    06bb2fc76d08b831f2fa9513ed6cd830

  • SHA1

    fa7e1b51e49ef679babefbf8ec36e6063ac30bbe

  • SHA256

    e76f20c61fd3a8c306a2e4901d864033df9a3bbde6d06420ebabaf13340d1311

  • SHA512

    4f220527b791acb1b6909b99b0630d50fc1ca7816a3f36feb9eab0b402f2ac33570c32247f38d936afb4da1878e08983d465e261996caf9a2342609a0b95cb2c

Malware Config

Targets

    • Target

      e76f20c61fd3a8c306a2e4901d864033df9a3bbde6d06420ebabaf13340d1311

    • Size

      5.0MB

    • MD5

      06bb2fc76d08b831f2fa9513ed6cd830

    • SHA1

      fa7e1b51e49ef679babefbf8ec36e6063ac30bbe

    • SHA256

      e76f20c61fd3a8c306a2e4901d864033df9a3bbde6d06420ebabaf13340d1311

    • SHA512

      4f220527b791acb1b6909b99b0630d50fc1ca7816a3f36feb9eab0b402f2ac33570c32247f38d936afb4da1878e08983d465e261996caf9a2342609a0b95cb2c

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

    • suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

      suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Tasks