Overview

overview

10

Static

static

6d2c13c880...da.exe

windows7_x64

10

6d2c13c880...da.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d2c13c880997089a4ea0590e9d6ef712fd13877322a143b6358c195a0abd3da

  • Size

    5.1MB

  • Sample

    220520-z5s4baded5

  • MD5

    26185a4a9d5685344ee846d62de4896b

  • SHA1

    9c0660a8ac0a957b2a74728e768524c2309be80f

  • SHA256

    6d2c13c880997089a4ea0590e9d6ef712fd13877322a143b6358c195a0abd3da

  • SHA512

    d20b40877316b318e4bec391577602076443273407e067b8a7ab36c97d7e7a9da790729493017495eecb9dbfdc244f5be244cc29f5ba8de85d616dd38873800c

Score
10/10
gluptebadropperevasionloaderpersistencesuricatatrojan

Malware Config

Targets

    • Target

      6d2c13c880997089a4ea0590e9d6ef712fd13877322a143b6358c195a0abd3da

    • Size

      5.1MB

    • MD5

      26185a4a9d5685344ee846d62de4896b

    • SHA1

      9c0660a8ac0a957b2a74728e768524c2309be80f

    • SHA256

      6d2c13c880997089a4ea0590e9d6ef712fd13877322a143b6358c195a0abd3da

    • SHA512

      d20b40877316b318e4bec391577602076443273407e067b8a7ab36c97d7e7a9da790729493017495eecb9dbfdc244f5be244cc29f5ba8de85d616dd38873800c

    Score
    10/10
    gluptebadropperevasionloaderpersistencesuricatatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

      evasiontrojan

    • suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

      suricata: ET MALWARE Glupteba CnC Domain in DNS Lookup

      suricata

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks