General

  • Target

    31970fb438c2430dc36f8a6a142af2f1400a5a5e9ba4f10207ed3cddea334c2d

  • Size

    4.1MB

  • Sample

    240509-qckf2aba5w

  • MD5

    a5422e7f8bbebc66adb427a97fbfcba3

  • SHA1

    f25d9673f7e668be9487b9296abe11d0adac8c87

  • SHA256

    31970fb438c2430dc36f8a6a142af2f1400a5a5e9ba4f10207ed3cddea334c2d

  • SHA512

    28327f03ea64fd365cf8bc415fb4f3dbb843ae2b6d2389ca724cebea3328adaf1faa2b72355451dd62abd738a6fc53dcf2941dfd48b02d801ce8dea8b3272eb4

  • SSDEEP

    98304:UsY/dZ96HSSh3za2WcnSdxBz+LIy5MjydJbomy+VuiahA2:3QZcza2WcnIxBnXOdJK+3UA2

Malware Config

Targets

    • Target

      31970fb438c2430dc36f8a6a142af2f1400a5a5e9ba4f10207ed3cddea334c2d

    • Size

      4.1MB

    • MD5

      a5422e7f8bbebc66adb427a97fbfcba3

    • SHA1

      f25d9673f7e668be9487b9296abe11d0adac8c87

    • SHA256

      31970fb438c2430dc36f8a6a142af2f1400a5a5e9ba4f10207ed3cddea334c2d

    • SHA512

      28327f03ea64fd365cf8bc415fb4f3dbb843ae2b6d2389ca724cebea3328adaf1faa2b72355451dd62abd738a6fc53dcf2941dfd48b02d801ce8dea8b3272eb4

    • SSDEEP

      98304:UsY/dZ96HSSh3za2WcnSdxBz+LIy5MjydJbomy+VuiahA2:3QZcza2WcnIxBnXOdJK+3UA2

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks