General

  • Target

    1395fce95a2ed182b56d8d1efec3f3c8edf3947e373adde348bdbcba4fc04a29

  • Size

    4.1MB

  • Sample

    240509-qbxpzadh28

  • MD5

    a2a709afef66da8108703956bac9068a

  • SHA1

    f04c555a4ed6dc424cd1c85c9ecc83da86d2e8dc

  • SHA256

    1395fce95a2ed182b56d8d1efec3f3c8edf3947e373adde348bdbcba4fc04a29

  • SHA512

    f9ab883565043db2b26f00804a4c54ba805622ffa8734ab9e680a1c5f0f3c43abbc9b9ca1a68eaa58c3a61a2a0a3c07e1ce6707200b3c2d79b9bf2044ad25d82

  • SSDEEP

    98304:8sY/dZ96HSSh3za2WcnSdxBz+LIy5MjydJbomy+VuiahAn:PQZcza2WcnIxBnXOdJK+3UAn

Malware Config

Targets

    • Target

      1395fce95a2ed182b56d8d1efec3f3c8edf3947e373adde348bdbcba4fc04a29

    • Size

      4.1MB

    • MD5

      a2a709afef66da8108703956bac9068a

    • SHA1

      f04c555a4ed6dc424cd1c85c9ecc83da86d2e8dc

    • SHA256

      1395fce95a2ed182b56d8d1efec3f3c8edf3947e373adde348bdbcba4fc04a29

    • SHA512

      f9ab883565043db2b26f00804a4c54ba805622ffa8734ab9e680a1c5f0f3c43abbc9b9ca1a68eaa58c3a61a2a0a3c07e1ce6707200b3c2d79b9bf2044ad25d82

    • SSDEEP

      98304:8sY/dZ96HSSh3za2WcnSdxBz+LIy5MjydJbomy+VuiahAn:PQZcza2WcnIxBnXOdJK+3UAn

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks