General

  • Target

    f56bff8dafd265b8d41684eade20590ff34142b07d76e62b920e59cdb503c9af

  • Size

    4.2MB

  • Sample

    240417-p8v2zahg9t

  • MD5

    976a0c4411fba656c3362a7244799007

  • SHA1

    0dc2fd1c7689b800cd9e418d2bb24a239cf1242d

  • SHA256

    f56bff8dafd265b8d41684eade20590ff34142b07d76e62b920e59cdb503c9af

  • SHA512

    2b82e2f4c9222abd6cdb2388852d55f34c2aeb1d2ca6f3253b08198a100f8fa3253d58b517dc057cdca5c73b48f88a612f9a36ca3c1f92647acca02ce600f4e3

  • SSDEEP

    98304:HwgJ0K+PIdMx0kJiFtsOSoRTiNy5FTeRdH/jgRnLKd+iGCp3lZyxxbli+:YPIhkJiF6OSCTez0RwjGiZklx

Malware Config

Targets

    • Target

      f56bff8dafd265b8d41684eade20590ff34142b07d76e62b920e59cdb503c9af

    • Size

      4.2MB

    • MD5

      976a0c4411fba656c3362a7244799007

    • SHA1

      0dc2fd1c7689b800cd9e418d2bb24a239cf1242d

    • SHA256

      f56bff8dafd265b8d41684eade20590ff34142b07d76e62b920e59cdb503c9af

    • SHA512

      2b82e2f4c9222abd6cdb2388852d55f34c2aeb1d2ca6f3253b08198a100f8fa3253d58b517dc057cdca5c73b48f88a612f9a36ca3c1f92647acca02ce600f4e3

    • SSDEEP

      98304:HwgJ0K+PIdMx0kJiFtsOSoRTiNy5FTeRdH/jgRnLKd+iGCp3lZyxxbli+:YPIhkJiF6OSCTez0RwjGiZklx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks