General

  • Target

    62332bf605736de5c3f5f457a914418ef32e9366d57b20b25b8f819c04bdf27b

  • Size

    4.1MB

  • Sample

    230608-al2tnsab5z

  • MD5

    1ded80b9120fddad155740e3068cb242

  • SHA1

    560247e9ea8c89e62875cc112135908cec25b633

  • SHA256

    62332bf605736de5c3f5f457a914418ef32e9366d57b20b25b8f819c04bdf27b

  • SHA512

    6ede1513fd675821ea2c1d8d1badd00a35bc70bbc7ecc15678520e25010c6bb3231c3f17cac7c2bca188756b1d527f175b14df8fda39070b62db6848ffc5ab23

  • SSDEEP

    98304:v8GtT7KONvb9Pix2XoCrEsQYjOARBWTRZ/y7nROr:vHBTb9PiwXZgsnFBYRZ/kYr

Malware Config

Targets

    • Target

      62332bf605736de5c3f5f457a914418ef32e9366d57b20b25b8f819c04bdf27b

    • Size

      4.1MB

    • MD5

      1ded80b9120fddad155740e3068cb242

    • SHA1

      560247e9ea8c89e62875cc112135908cec25b633

    • SHA256

      62332bf605736de5c3f5f457a914418ef32e9366d57b20b25b8f819c04bdf27b

    • SHA512

      6ede1513fd675821ea2c1d8d1badd00a35bc70bbc7ecc15678520e25010c6bb3231c3f17cac7c2bca188756b1d527f175b14df8fda39070b62db6848ffc5ab23

    • SSDEEP

      98304:v8GtT7KONvb9Pix2XoCrEsQYjOARBWTRZ/y7nROr:vHBTb9PiwXZgsnFBYRZ/kYr

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Tasks