General

  • Target

    7ba6ae314a7fab2e915c192ce70ed424d137f200c283e66b5ec363a286d87de8

  • Size

    3.8MB

  • Sample

    220731-k5nfhaaehl

  • MD5

    a48321bdb9ba41e170321462c782d29f

  • SHA1

    62ed4f778aee089299a891bdc2620b15d75622b9

  • SHA256

    7ba6ae314a7fab2e915c192ce70ed424d137f200c283e66b5ec363a286d87de8

  • SHA512

    a5be147f919a23a0a7600adc29e2afc4e6f23f9a99829d4abfbb752dfff3ca3b4abbbba5fdd47f2001cf5103c48c9351dca375725f68439af9663eca49fe40ad

Malware Config

Targets

    • Target

      7ba6ae314a7fab2e915c192ce70ed424d137f200c283e66b5ec363a286d87de8

    • Size

      3.8MB

    • MD5

      a48321bdb9ba41e170321462c782d29f

    • SHA1

      62ed4f778aee089299a891bdc2620b15d75622b9

    • SHA256

      7ba6ae314a7fab2e915c192ce70ed424d137f200c283e66b5ec363a286d87de8

    • SHA512

      a5be147f919a23a0a7600adc29e2afc4e6f23f9a99829d4abfbb752dfff3ca3b4abbbba5fdd47f2001cf5103c48c9351dca375725f68439af9663eca49fe40ad

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Tasks