Overview

overview

10

Static

static

45164f55a3...df.exe

windows7_x64

10

45164f55a3...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45164f55a319aeb0e3c3a959c9169c5f464bc95af4efcd9f56befef7208371df

  • Size

    3.9MB

  • Sample

    220509-ax1ezsbge6

  • MD5

    2be54f9ad0468543a07a896b5fc5030c

  • SHA1

    9a8e7d24190ce69979119add12194bdc17101923

  • SHA256

    45164f55a319aeb0e3c3a959c9169c5f464bc95af4efcd9f56befef7208371df

  • SHA512

    08a95e2be1fa32faa3c38c50a13cf78fb0f201209dedd25b160eefccde8f18d8500d1809cd3cb9d08f6ed754dcd154c576c7986759d17aaa7496793d71175f31

Score
10/10
gluptebadropperevasionloader

Malware Config

Targets

    • Target

      45164f55a319aeb0e3c3a959c9169c5f464bc95af4efcd9f56befef7208371df

    • Size

      3.9MB

    • MD5

      2be54f9ad0468543a07a896b5fc5030c

    • SHA1

      9a8e7d24190ce69979119add12194bdc17101923

    • SHA256

      45164f55a319aeb0e3c3a959c9169c5f464bc95af4efcd9f56befef7208371df

    • SHA512

      08a95e2be1fa32faa3c38c50a13cf78fb0f201209dedd25b160eefccde8f18d8500d1809cd3cb9d08f6ed754dcd154c576c7986759d17aaa7496793d71175f31

    Score
    10/10
    gluptebadropperevasionloader

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Modifies Windows Firewall

      evasion

    • Modifies boot configuration data using bcdedit

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks