glupteba

General

Target

22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f
Size

3.8MB
Sample

220201-js28fsbfc9
MD5

528b632a2846b97d1d6bc9756445a6d2
SHA1

a68b1b48327ea370288a3c8e70f720b227814d4b
SHA256

22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f
SHA512

6da07734df2bb392a48bae53fbeec2519a1b62bf5e35ec49543fb7d8e9e3e26bbdf8169531dd9217a8c1958890aa3e865002fbca1f78b94e994ac3ca3a8bfb6f

Score

10^/10

Malware Config

Targets

- Target
  
  22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f
- Size
  
  3.8MB
- MD5
  
  528b632a2846b97d1d6bc9756445a6d2
- SHA1
  
  a68b1b48327ea370288a3c8e70f720b227814d4b
- SHA256
  
  22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f
- SHA512
  
  6da07734df2bb392a48bae53fbeec2519a1b62bf5e35ec49543fb7d8e9e3e26bbdf8169531dd9217a8c1958890aa3e865002fbca1f78b94e994ac3ca3a8bfb6f
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Glupteba Payload

Windows security bypass

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2