Description
Glupteba is a modular loader written in Golang with various components.
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
General
Target
Size
Sample
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
3MB
220520-2ac5qafaa4
Score
10 /10
MD5
SHA1
SHA256
SHA512
c40e14338592240c54c328318963b3bb
0026ef8f4f8baaeda070e1f306e2a7618a8b2e6d
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
292bb0075078174a848ee6a7ce74654bcfbdb1ba590461c9cc3203ae9d0286a5965c34ff6b317d05372e517238c504aeb0dc1ae9523ca6a311ec27c6583aab95
Malware Config
Targets
Target
MD5
Filesize
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
c40e14338592240c54c328318963b3bb
3MB
Score
10/10
SHA1
SHA256
SHA512
0026ef8f4f8baaeda070e1f306e2a7618a8b2e6d
6be50ece7dd7688a2c951307b1eb8a78544dc360fccb3dcc44b42e33c7d3351a
292bb0075078174a848ee6a7ce74654bcfbdb1ba590461c9cc3203ae9d0286a5965c34ff6b317d05372e517238c504aeb0dc1ae9523ca6a311ec27c6583aab95
Tags
Signatures
-
Glupteba
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Windows security bypass
Tags
TTPs
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Loads dropped DLL
-
Windows security modification
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks