General

  • Target

    ea316ed87162a0340980f1ed51d8572caf4ac91f1a7681fe95de1d2148d19ae5

  • Size

    4.1MB

  • Sample

    240509-szkfnahb3y

  • MD5

    d534434d452f35e133045a3c48abb597

  • SHA1

    3803ef71e3ba6456b34d24e4386eb7ed9af0a007

  • SHA256

    ea316ed87162a0340980f1ed51d8572caf4ac91f1a7681fe95de1d2148d19ae5

  • SHA512

    15684bec412a3b8407dbabbee967e025828df608d40a4f713947a373b7eb3def69fa6a33a49c246c33c16f953fbd4c299b633d961e93234252e26e2f66faea74

  • SSDEEP

    49152:KFHjWOXMS9cl73TW4F7CigoH4vE0j/gZI9yVcR+W62NZfYFwnO0lzL3OOHbQBqF6:KFDbcVB3TFxHH43Ma9n+52NVhL/oBqqR

Malware Config

Targets

    • Target

      ea316ed87162a0340980f1ed51d8572caf4ac91f1a7681fe95de1d2148d19ae5

    • Size

      4.1MB

    • MD5

      d534434d452f35e133045a3c48abb597

    • SHA1

      3803ef71e3ba6456b34d24e4386eb7ed9af0a007

    • SHA256

      ea316ed87162a0340980f1ed51d8572caf4ac91f1a7681fe95de1d2148d19ae5

    • SHA512

      15684bec412a3b8407dbabbee967e025828df608d40a4f713947a373b7eb3def69fa6a33a49c246c33c16f953fbd4c299b633d961e93234252e26e2f66faea74

    • SSDEEP

      49152:KFHjWOXMS9cl73TW4F7CigoH4vE0j/gZI9yVcR+W62NZfYFwnO0lzL3OOHbQBqF6:KFDbcVB3TFxHH43Ma9n+52NVhL/oBqqR

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks