General

  • Target

    tmp

  • Size

    404KB

  • Sample

    240420-m6td9afa45

  • MD5

    15ce9e885610d5b85500ea0d139f6d21

  • SHA1

    99f1392185a70453f33e15d6f5b75064217c2c18

  • SHA256

    95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e

  • SHA512

    9ee8e3fb682cf7abb5804106f841551f2f0fd8ace9842e67f3bda573772d39a6482d19e853de5a9a48d177350a3398cb814105ced01fdfb1be6db7e8bc9055b9

  • SSDEEP

    6144:/IJTLRoSz47P8DiLdwXQIPcnEPjj9tQPBBpRPZi9opzUeqcnoKPcmPuJkJ:wlRoSz4j8DM6gIxfUP+2Ye9oCcmf

Malware Config

Targets

    • Target

      tmp

    • Size

      404KB

    • MD5

      15ce9e885610d5b85500ea0d139f6d21

    • SHA1

      99f1392185a70453f33e15d6f5b75064217c2c18

    • SHA256

      95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e

    • SHA512

      9ee8e3fb682cf7abb5804106f841551f2f0fd8ace9842e67f3bda573772d39a6482d19e853de5a9a48d177350a3398cb814105ced01fdfb1be6db7e8bc9055b9

    • SSDEEP

      6144:/IJTLRoSz47P8DiLdwXQIPcnEPjj9tQPBBpRPZi9opzUeqcnoKPcmPuJkJ:wlRoSz4j8DM6gIxfUP+2Ye9oCcmf

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • UAC bypass

    • Windows security bypass

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Windows security modification

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks