General

  • Target

    e78201736aa3c6008eb8bcdcf0f854bec079b2b4cd56e13e23e956814b67b914

  • Size

    4.1MB

  • Sample

    240515-lrx88abg31

  • MD5

    ffe24c2cab340b29f0e60dc19ccf3d45

  • SHA1

    879c1834144f5247f8386c21e844bba43a969a69

  • SHA256

    e78201736aa3c6008eb8bcdcf0f854bec079b2b4cd56e13e23e956814b67b914

  • SHA512

    a87c05688168e8aaff2c05c726fd21eeb9c0e77c701521cca7ca20e8b5f4110d81fc25695a0ec88462508d399a02549c0c3dfeca497f62410f3f8c987f19b1c4

  • SSDEEP

    98304:TrCNiB8ow0tjGRwMUUAJnC6DPNgwm1X3ykRpk8yR82N67:TrCy8l0I4UGC6Dg3yk88np7

Malware Config

Targets

    • Target

      e78201736aa3c6008eb8bcdcf0f854bec079b2b4cd56e13e23e956814b67b914

    • Size

      4.1MB

    • MD5

      ffe24c2cab340b29f0e60dc19ccf3d45

    • SHA1

      879c1834144f5247f8386c21e844bba43a969a69

    • SHA256

      e78201736aa3c6008eb8bcdcf0f854bec079b2b4cd56e13e23e956814b67b914

    • SHA512

      a87c05688168e8aaff2c05c726fd21eeb9c0e77c701521cca7ca20e8b5f4110d81fc25695a0ec88462508d399a02549c0c3dfeca497f62410f3f8c987f19b1c4

    • SSDEEP

      98304:TrCNiB8ow0tjGRwMUUAJnC6DPNgwm1X3ykRpk8yR82N67:TrCy8l0I4UGC6Dg3yk88np7

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks