General
- Target tmps68t8h4u
- Size 4.8MB
- Sample260602-mcwmhsaz3x
- SHA256 f3d49a26f46d47594ea0be657c4b80fa1c1fb82998e7347ee3e7425cf4b9e494
Malware Config
Targets
-
- Target tmps68t8h4u
- Size 4.8MB
- SHA256 f3d49a26f46d47594ea0be657c4b80fa1c1fb82998e7347ee3e7425cf4b9e494
Score10/10Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
Glupteba payload
Windows security bypass
Modifies Windows Firewall
Executes dropped EXE
Windows security modification
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Manipulates WinMonFS driver.
Roottkits write to WinMonFS to hide directories/files from being detected.
Modifies boot configuration data using bcdedit
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
2Install Root Certificate
2