General

  • Target

    73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41

  • Size

    4.2MB

  • Sample

    240420-nwhqfagd5t

  • MD5

    ab1ada7b0944f65ed0bdb3512c655f83

  • SHA1

    7a1a23ec95931672d4d75bc0a9f73a9e68cd938f

  • SHA256

    73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41

  • SHA512

    2c845cb505b6633b6ec6e5906f490b06b17b7c63562b31a973845a2810dd19257acedbf9d4aea4cc510fb1a8b3c70ceefaa9c0a116f0a561e2bd9a246673ca53

  • SSDEEP

    98304:CExeyMsyixS5pRc4vIUtzCuveHCg7xBa+u+nRp:CMby0Sruak17xws

Malware Config

Targets

    • Target

      73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41

    • Size

      4.2MB

    • MD5

      ab1ada7b0944f65ed0bdb3512c655f83

    • SHA1

      7a1a23ec95931672d4d75bc0a9f73a9e68cd938f

    • SHA256

      73fc973779c895a26d24d83f0becafa0e76f59abf6627047ae94937d52197f41

    • SHA512

      2c845cb505b6633b6ec6e5906f490b06b17b7c63562b31a973845a2810dd19257acedbf9d4aea4cc510fb1a8b3c70ceefaa9c0a116f0a561e2bd9a246673ca53

    • SSDEEP

      98304:CExeyMsyixS5pRc4vIUtzCuveHCg7xBa+u+nRp:CMby0Sruak17xws

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks