Overview

overview

10

Static

static

7ba65ed25e...5e.exe

windows7_x64

10

7ba65ed25e...5e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ba65ed25eaa97c6dc38d16a2d4255141237ad266fb85fbe35cb257d4e46815e

  • Size

    5.1MB

  • Sample

    220520-rr3ftsgce4

  • MD5

    fa7d5ed7ede165559ea6ad8eca4b80fd

  • SHA1

    362fb00be5538cf986656f85b53b5b1afe4d685c

  • SHA256

    7ba65ed25eaa97c6dc38d16a2d4255141237ad266fb85fbe35cb257d4e46815e

  • SHA512

    309287c6b622b2e45b15f9a09505eb78e501c8809f598dd7ba637f0020072fb5a6dc9a7034122cf89e55c33ad03914bd7c3ba090cca072446b063af831c64539

Score
10/10
gluptebadropperevasionloaderpersistencesuricatatrojan

Malware Config

Targets

    • Target

      7ba65ed25eaa97c6dc38d16a2d4255141237ad266fb85fbe35cb257d4e46815e

    • Size

      5.1MB

    • MD5

      fa7d5ed7ede165559ea6ad8eca4b80fd

    • SHA1

      362fb00be5538cf986656f85b53b5b1afe4d685c

    • SHA256

      7ba65ed25eaa97c6dc38d16a2d4255141237ad266fb85fbe35cb257d4e46815e

    • SHA512

      309287c6b622b2e45b15f9a09505eb78e501c8809f598dd7ba637f0020072fb5a6dc9a7034122cf89e55c33ad03914bd7c3ba090cca072446b063af831c64539

    Score
    10/10
    gluptebadropperevasionloaderpersistencesuricatatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

      evasiontrojan

    • suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

      suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

      suricata

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks