General

  • Target

    eb3f1955afe0a850433f4eb4fa7ccf5ea955027f67fd3247e1708cf2a3c9e657

  • Size

    4.2MB

  • Sample

    230607-s2mc2acc78

  • MD5

    806e03556e2ec1a8c01da5c04bc09efb

  • SHA1

    93d05ad3ff30d7bce4e1ca916bf0d8b4f5209bae

  • SHA256

    eb3f1955afe0a850433f4eb4fa7ccf5ea955027f67fd3247e1708cf2a3c9e657

  • SHA512

    ed058d771322c925864f84ddfe433c506bd9e0ee2179b2ee646bfc7ebb302db65c5281b6c6c96740b15ad24ee08158c4cb3b78776b4b17410b1b6e22125e0890

  • SSDEEP

    98304:IXBXbxwMASR72enw18wQxWVMeT7u+9UVKOQ5LwfsZVn:UBLxkG72BAWVJXuzQ5LH

Malware Config

Targets

    • Target

      eb3f1955afe0a850433f4eb4fa7ccf5ea955027f67fd3247e1708cf2a3c9e657

    • Size

      4.2MB

    • MD5

      806e03556e2ec1a8c01da5c04bc09efb

    • SHA1

      93d05ad3ff30d7bce4e1ca916bf0d8b4f5209bae

    • SHA256

      eb3f1955afe0a850433f4eb4fa7ccf5ea955027f67fd3247e1708cf2a3c9e657

    • SHA512

      ed058d771322c925864f84ddfe433c506bd9e0ee2179b2ee646bfc7ebb302db65c5281b6c6c96740b15ad24ee08158c4cb3b78776b4b17410b1b6e22125e0890

    • SSDEEP

      98304:IXBXbxwMASR72enw18wQxWVMeT7u+9UVKOQ5LwfsZVn:UBLxkG72BAWVJXuzQ5LH

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Tasks