General

  • Target

    de1b7ea648635719f1e16b86a7176cc8dd8607b73bd09b6c64c21ecd08e5366d

  • Size

    4.1MB

  • Sample

    240517-qba6zaad54

  • MD5

    76cd6498f5289453cb0cdd2e14daeeee

  • SHA1

    fa531559fb47ff2aaa9d46c19cacdae152b4a7d9

  • SHA256

    de1b7ea648635719f1e16b86a7176cc8dd8607b73bd09b6c64c21ecd08e5366d

  • SHA512

    adbca2478a569ed21f0f786e8c90f7dcd7ee4f0b8cfed79e6e0970863d569c30efc2f4ee4fb4aaf1cb1209333dfb7232b29dd0b142ea96b1d59298785eec1b08

  • SSDEEP

    98304:3hzlfCz+ccJ0CpUiRHjJlGcG1klIkRd3fLKEvd:Rz9CiccJ0CpfGcGG1DfL/

Malware Config

Targets

    • Target

      de1b7ea648635719f1e16b86a7176cc8dd8607b73bd09b6c64c21ecd08e5366d

    • Size

      4.1MB

    • MD5

      76cd6498f5289453cb0cdd2e14daeeee

    • SHA1

      fa531559fb47ff2aaa9d46c19cacdae152b4a7d9

    • SHA256

      de1b7ea648635719f1e16b86a7176cc8dd8607b73bd09b6c64c21ecd08e5366d

    • SHA512

      adbca2478a569ed21f0f786e8c90f7dcd7ee4f0b8cfed79e6e0970863d569c30efc2f4ee4fb4aaf1cb1209333dfb7232b29dd0b142ea96b1d59298785eec1b08

    • SSDEEP

      98304:3hzlfCz+ccJ0CpUiRHjJlGcG1klIkRd3fLKEvd:Rz9CiccJ0CpfGcGG1DfL/

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks