General

  • Target

    46d207b7bb702224fa76ac1188d291dbb4033123f483e61705a672a92496f3d3

  • Size

    6.2MB

  • Sample

    220725-c3zrrabdgm

  • MD5

    14bf68dc4ce2a71f00a1604b69cc07f7

  • SHA1

    be75773e9034b1e5130c1c95e0054204d22e995c

  • SHA256

    46d207b7bb702224fa76ac1188d291dbb4033123f483e61705a672a92496f3d3

  • SHA512

    6bb0614ee84e519892affd4f585ec9d786763b51f9aac59e462d027a0290704362a327a2923e386bbdec48cca669b159f907b6700965fd4f39ff7b0a5ccb5eb7

Malware Config

Targets

    • Target

      46d207b7bb702224fa76ac1188d291dbb4033123f483e61705a672a92496f3d3

    • Size

      6.2MB

    • MD5

      14bf68dc4ce2a71f00a1604b69cc07f7

    • SHA1

      be75773e9034b1e5130c1c95e0054204d22e995c

    • SHA256

      46d207b7bb702224fa76ac1188d291dbb4033123f483e61705a672a92496f3d3

    • SHA512

      6bb0614ee84e519892affd4f585ec9d786763b51f9aac59e462d027a0290704362a327a2923e386bbdec48cca669b159f907b6700965fd4f39ff7b0a5ccb5eb7

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

    • suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

      suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Tasks