glupteba

General

Target

3E5CCB6DCBB35257F07CA1E59BDE0FDE.exe
Size

1.5MB
Sample

210824-xv4t86txp2
MD5

3e5ccb6dcbb35257f07ca1e59bde0fde
SHA1

39ecf0317a54a69a4454282984b1916787cf6154
SHA256

4101bd379660a169d50442c9921d6fb0329620efbc5a163856c2f5e5f41e601c
SHA512

0486d713d89e64e21a484a619fc4e2ecb8c36d700e7eac741d84e50e8be8b0e72e43eefacde15d09cace7107b7314caebea679b8fb5058ab63a8b1e707623e8e

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

supertraff

C2

135.148.139.222:1494

Extracted

Family

redline

Botnet

v2

C2

195.2.78.163:25450

Extracted

Family

redline

Botnet

24.08

C2

95.181.172.100:55640

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

40.1

Botnet

937

C2

https://eduarroma.tumblr.com/

Attributes

profile_id
937

Targets

- Target
  
  3E5CCB6DCBB35257F07CA1E59BDE0FDE.exe
- Size
  
  1.5MB
- MD5
  
  3e5ccb6dcbb35257f07ca1e59bde0fde
- SHA1
  
  39ecf0317a54a69a4454282984b1916787cf6154
- SHA256
  
  4101bd379660a169d50442c9921d6fb0329620efbc5a163856c2f5e5f41e601c
- SHA512
  
  0486d713d89e64e21a484a619fc4e2ecb8c36d700e7eac741d84e50e8be8b0e72e43eefacde15d09cace7107b7314caebea679b8fb5058ab63a8b1e707623e8e
Score

10^/10

redline 24.08 supertraff v2 evasion infostealer themida trojan glupteba metasploit vidar 937 backdoor dropper loader stealer
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2