General

  • Target

    34eff3bd93fd79a9cfd2e4d5397063b64f3dd109d1774acf6f263ae62550b9a0

  • Size

    4.1MB

  • Sample

    240509-qbyx2adh34

  • MD5

    529d5b0bd3d8f697ef3880d6c9f90e0c

  • SHA1

    0c71920348c8656984bc7db7868190c7fdabba97

  • SHA256

    34eff3bd93fd79a9cfd2e4d5397063b64f3dd109d1774acf6f263ae62550b9a0

  • SHA512

    3e37dea31672d3c4f8c2f3f5ec379d0898f7c8d3750f3dfe5c8d52fb4463fc179978bc492a284921bc029d5750ba8b3a5e4b73bfaf4124db07a68fc8058ac382

  • SSDEEP

    98304:8sY/dZ96HSSh3za2WcnSdxBz+LIy5MjydJbomy+VuiahA2:PQZcza2WcnIxBnXOdJK+3UA2

Malware Config

Targets

    • Target

      34eff3bd93fd79a9cfd2e4d5397063b64f3dd109d1774acf6f263ae62550b9a0

    • Size

      4.1MB

    • MD5

      529d5b0bd3d8f697ef3880d6c9f90e0c

    • SHA1

      0c71920348c8656984bc7db7868190c7fdabba97

    • SHA256

      34eff3bd93fd79a9cfd2e4d5397063b64f3dd109d1774acf6f263ae62550b9a0

    • SHA512

      3e37dea31672d3c4f8c2f3f5ec379d0898f7c8d3750f3dfe5c8d52fb4463fc179978bc492a284921bc029d5750ba8b3a5e4b73bfaf4124db07a68fc8058ac382

    • SSDEEP

      98304:8sY/dZ96HSSh3za2WcnSdxBz+LIy5MjydJbomy+VuiahA2:PQZcza2WcnIxBnXOdJK+3UA2

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks