glupteba

General

Target

a702ea4d44b0cd2e341503175f84b0d2.exe
Size

4.7MB
Sample

210831-faggt72rz6
MD5

a702ea4d44b0cd2e341503175f84b0d2
SHA1

d150c401bec51556ccce1cbd3ec286a3cd529e62
SHA256

3549672c8de23efbeec55aeef7925d4bf778b4683252084e04c7ceb6a50b9393
SHA512

93ae58177375ac4e8fc06e8435fd3174eff6c67fab1ad3ea0e51fdcd35db2368ba69cd2a6e12c90c7f62a790ffb324b8af4215de7661f4f4feec22e0aaa623a6

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

rc4.i32

Extracted

Family

raccoon

Botnet

10c753321b3ff323727f510579572aa4c5ea00cb

Attributes

url4cnc
https://telete.in/bimboDinotrex

rc4.plain

Extracted

Family

vidar

Version

40.1

Botnet

706

C2

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  a702ea4d44b0cd2e341503175f84b0d2.exe
- Size
  
  4.7MB
- MD5
  
  a702ea4d44b0cd2e341503175f84b0d2
- SHA1
  
  d150c401bec51556ccce1cbd3ec286a3cd529e62
- SHA256
  
  3549672c8de23efbeec55aeef7925d4bf778b4683252084e04c7ceb6a50b9393
- SHA512
  
  93ae58177375ac4e8fc06e8435fd3174eff6c67fab1ad3ea0e51fdcd35db2368ba69cd2a6e12c90c7f62a790ffb324b8af4215de7661f4f4feec22e0aaa623a6
Score

10^/10

raccoon smokeloader 10c753321b3ff323727f510579572aa4c5ea00cb aspackv2 backdoor stealer themida trojan glupteba metasploit vidar 706 discovery dropper evasion loader persistence suricata
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Windows security bypass
  evasion trojan
- suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata
- suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
  suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
  suricata
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2