General

  • Target

    ee35071624938dc7c0b6c8a78d4f5b2abc001a9d2b04d4c8be640bd43c93e844

  • Size

    4.2MB

  • Sample

    240419-ez8llahf6x

  • MD5

    4a07dcf2b32eb7b9ed9cc830640c091c

  • SHA1

    43863aecf373ebf04f5e18abfd1a8be1e678949b

  • SHA256

    ee35071624938dc7c0b6c8a78d4f5b2abc001a9d2b04d4c8be640bd43c93e844

  • SHA512

    89fa953d3a91431bd79a7b7655021d20859ca54bd95a821dc2fd160f29304b829efcd659f52147f7956fb88384f1610a0e0f484271904d1e21020fd0dc1367dd

  • SSDEEP

    98304:MRUBmLZ3rmtSop/fcfKtwQG3TQtt4oKMJO6VS6U7CKzh79:UxKEC/fcfKt9ykOWRUGoh79

Malware Config

Targets

    • Target

      ee35071624938dc7c0b6c8a78d4f5b2abc001a9d2b04d4c8be640bd43c93e844

    • Size

      4.2MB

    • MD5

      4a07dcf2b32eb7b9ed9cc830640c091c

    • SHA1

      43863aecf373ebf04f5e18abfd1a8be1e678949b

    • SHA256

      ee35071624938dc7c0b6c8a78d4f5b2abc001a9d2b04d4c8be640bd43c93e844

    • SHA512

      89fa953d3a91431bd79a7b7655021d20859ca54bd95a821dc2fd160f29304b829efcd659f52147f7956fb88384f1610a0e0f484271904d1e21020fd0dc1367dd

    • SSDEEP

      98304:MRUBmLZ3rmtSop/fcfKtwQG3TQtt4oKMJO6VS6U7CKzh79:UxKEC/fcfKt9ykOWRUGoh79

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks