Description
Glupteba is a modular loader written in Golang with various components.
General
Target
Size
Sample
ce66310aced7f576549cd39457bbf6a8425c1a0943510d75f7d7ce72b90fdfc0
3MB
220524-q3skbsdaf4
Score
10/10
MD5
SHA1
SHA256
SHA512
2064e3bb7a3826464992decb043a1c13
ac04cc98f073e6ee77fb56430578b20b07bb9fb0
ce66310aced7f576549cd39457bbf6a8425c1a0943510d75f7d7ce72b90fdfc0
9dc5847a95df367f3be4d0dac56afdfd580c1d53b1ca2266cc06e22c9d7b708fcae8f7971fe9d9b848bdb1e8bf8ed9f61334d8a19e68fc400fde269bbb5614c7
Malware Config
Targets
Target
MD5
Filesize
ce66310aced7f576549cd39457bbf6a8425c1a0943510d75f7d7ce72b90fdfc0
2064e3bb7a3826464992decb043a1c13
3MB
Score
10/10
SHA1
SHA256
SHA512
ac04cc98f073e6ee77fb56430578b20b07bb9fb0
ce66310aced7f576549cd39457bbf6a8425c1a0943510d75f7d7ce72b90fdfc0
9dc5847a95df367f3be4d0dac56afdfd580c1d53b1ca2266cc06e22c9d7b708fcae8f7971fe9d9b848bdb1e8bf8ed9f61334d8a19e68fc400fde269bbb5614c7
Tags
Signatures
-
Glupteba
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Windows security bypass
Tags
TTPs
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Loads dropped DLL
-
Windows security modification
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10