General

  • Target

    49d54d624f06f67b57bc60a8c2bcd7ae88786e03113d96e0da2105bad0645cb9

  • Size

    4.1MB

  • Sample

    240509-ttlxzaba5s

  • MD5

    76caa87a011dce08432e8dc6eb920074

  • SHA1

    924c2886e2eb317ceec80c35f1b41a87f9705d56

  • SHA256

    49d54d624f06f67b57bc60a8c2bcd7ae88786e03113d96e0da2105bad0645cb9

  • SHA512

    9b5785ddd8a57770aac2073fbfa52e9a258a53c5d72284bc53bd896322899b429a1b02f68fd98a0d63a8be82fc2df5cc1949ac80d718c70899c243f7b23e3d83

  • SSDEEP

    98304:ygQj3bYke7IH4UmHBe7fvGvGegFjoB9Y4hH2MnS9a/:dmkkc0oEfvGFgFjKYMWd6

Malware Config

Targets

    • Target

      49d54d624f06f67b57bc60a8c2bcd7ae88786e03113d96e0da2105bad0645cb9

    • Size

      4.1MB

    • MD5

      76caa87a011dce08432e8dc6eb920074

    • SHA1

      924c2886e2eb317ceec80c35f1b41a87f9705d56

    • SHA256

      49d54d624f06f67b57bc60a8c2bcd7ae88786e03113d96e0da2105bad0645cb9

    • SHA512

      9b5785ddd8a57770aac2073fbfa52e9a258a53c5d72284bc53bd896322899b429a1b02f68fd98a0d63a8be82fc2df5cc1949ac80d718c70899c243f7b23e3d83

    • SSDEEP

      98304:ygQj3bYke7IH4UmHBe7fvGvGegFjoB9Y4hH2MnS9a/:dmkkc0oEfvGFgFjKYMWd6

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks