Description
Glupteba is a modular loader written in Golang with various components.
General
Target
Size
Sample
f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9
3MB
220524-q5wprsgfak
Score
10/10
MD5
SHA1
SHA256
SHA512
d8553d002a6764dc4995da92cb51fa2b
b5746050922832f0eab74bea5dda43357af139b1
f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9
2417a348a6de672724b94406063138bbc17c23f7181c48bf4a5d02322723df28a48a751a130077125d8ceb5985a1da6729b196070e064a8a5251c44f5dceb8c6
Malware Config
Targets
Target
MD5
Filesize
f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9
d8553d002a6764dc4995da92cb51fa2b
3MB
Score
10/10
SHA1
SHA256
SHA512
b5746050922832f0eab74bea5dda43357af139b1
f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9
2417a348a6de672724b94406063138bbc17c23f7181c48bf4a5d02322723df28a48a751a130077125d8ceb5985a1da6729b196070e064a8a5251c44f5dceb8c6
Tags
Signatures
-
Glupteba
-
Glupteba Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
8/10
behavioral2
Score
10/10