Description
Glupteba is a modular loader written in Golang with various components.
General
Target
Size
Sample
cf9f6fd53b9d9ea86f78171f668c7bc1df8aed394ff5cf4b41ced05cbce014b5
3MB
220523-zv677abefp
Score
10/10
MD5
SHA1
SHA256
SHA512
865660822e59b4e6dfbbc1558adc33bf
327c98174279ecdd472ad263748723207293b704
cf9f6fd53b9d9ea86f78171f668c7bc1df8aed394ff5cf4b41ced05cbce014b5
4bfe2015c0d4d4c5ed1fa5860a207e635e8ea8bd639a47680a477ece2b861a7b83f227e5e5ec96145ff23784cdbf9fcd3e940c7af4d396ac66fa02be30835d17
Malware Config
Targets
Target
MD5
Filesize
cf9f6fd53b9d9ea86f78171f668c7bc1df8aed394ff5cf4b41ced05cbce014b5
865660822e59b4e6dfbbc1558adc33bf
3MB
Score
10/10
SHA1
SHA256
SHA512
327c98174279ecdd472ad263748723207293b704
cf9f6fd53b9d9ea86f78171f668c7bc1df8aed394ff5cf4b41ced05cbce014b5
4bfe2015c0d4d4c5ed1fa5860a207e635e8ea8bd639a47680a477ece2b861a7b83f227e5e5ec96145ff23784cdbf9fcd3e940c7af4d396ac66fa02be30835d17
Tags
Signatures
-
Glupteba
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Windows security bypass
Tags
TTPs
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Loads dropped DLL
-
Windows security modification
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Modifies boot configuration data using bcdedit
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10