General

  • Target

    3830cdec171094b7eca7c6b463b0b053a59ec539785d973b7d0c797d11f81120

  • Size

    4.2MB

  • Sample

    240419-lfjxfsef3t

  • MD5

    06ca8254d9947d0060abfabf7ef73cca

  • SHA1

    0fff7abf61440df135ce4ba3086e822825080b93

  • SHA256

    3830cdec171094b7eca7c6b463b0b053a59ec539785d973b7d0c797d11f81120

  • SHA512

    523b2dafc4ae58f8d9e7957f22246f08882ecee25e7b9eedc100d65163f9db6a70233d3664f90cc202aa3931024dc2f4125497f3f6ff0dd7745c9c6f7d9f4496

  • SSDEEP

    98304:1IBNXOOfwLGhP6KRoj027D5HGyNAiNcOh9MZ99WifgA28ff94ZQ:cjfa7j0YDNAHCC9Miz28ff3

Malware Config

Targets

    • Target

      3830cdec171094b7eca7c6b463b0b053a59ec539785d973b7d0c797d11f81120

    • Size

      4.2MB

    • MD5

      06ca8254d9947d0060abfabf7ef73cca

    • SHA1

      0fff7abf61440df135ce4ba3086e822825080b93

    • SHA256

      3830cdec171094b7eca7c6b463b0b053a59ec539785d973b7d0c797d11f81120

    • SHA512

      523b2dafc4ae58f8d9e7957f22246f08882ecee25e7b9eedc100d65163f9db6a70233d3664f90cc202aa3931024dc2f4125497f3f6ff0dd7745c9c6f7d9f4496

    • SSDEEP

      98304:1IBNXOOfwLGhP6KRoj027D5HGyNAiNcOh9MZ99WifgA28ff94ZQ:cjfa7j0YDNAHCC9Miz28ff3

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks