glupteba

General

Target

C24D05331D2CF344AF12C1C169270846.exe
Size

940KB
Sample

210703-h1nberqjv2
MD5

c24d05331d2cf344af12c1c169270846
SHA1

eeab48b61aabf4a403a5feb47b9b88c31d63b525
SHA256

8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884
SHA512

379a145b157501d7aa09f599390f7e14e1f81b7f0f017eebe6084ee534c171760de63a0888d608ec05455304f0cc70a9fdb7dc53421a496f4968e8d6198a4afa

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

916

C2

https://sergeevih43.tumblr.com

Attributes

profile_id
916

Extracted

Family

zloader

Botnet

vasja

Campaign

vasja

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Extracted

Family

redline

Botnet

DomLyla

C2

detuyaluro.xyz:80

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

39.4

Botnet

915

C2

https://sergeevih43.tumblr.com

Attributes

profile_id
915

Targets

- Target
  
  C24D05331D2CF344AF12C1C169270846.exe
- Size
  
  940KB
- MD5
  
  c24d05331d2cf344af12c1c169270846
- SHA1
  
  eeab48b61aabf4a403a5feb47b9b88c31d63b525
- SHA256
  
  8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884
- SHA512
  
  379a145b157501d7aa09f599390f7e14e1f81b7f0f017eebe6084ee534c171760de63a0888d608ec05455304f0cc70a9fdb7dc53421a496f4968e8d6198a4afa
Score

10^/10

glupteba metasploit redline vidar zloader 915 916 domlyla vasja vasja backdoor botnet discovery dropper evasion infostealer loader persistence spyware stealer trojan vmprotect upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Vidar Stealer
  stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2