Description
Glupteba is a modular loader written in Golang with various components.
General
Target
Size
Sample
1949e1a48df5ec684a0fc0f6bd3ee4119a29954b356cd17bfd7a1bc4daaf7216
3MB
220524-q6be8agfbp
Score
10/10
MD5
SHA1
SHA256
SHA512
b6cbd52f048d0b356f1b67ff2e783860
2539e01b0d761b64c4a74da6a2ebe2da85e68214
1949e1a48df5ec684a0fc0f6bd3ee4119a29954b356cd17bfd7a1bc4daaf7216
2b0072427aef5d3ee5a0411309f018b2c6c4b126c6eb2a4f1d996a6e7ced5e8849558a3a6bdce45b41b9c2f98378a610cb8ea24dba5e76edc2756a39340ec2a8
Malware Config
Targets
Target
MD5
Filesize
1949e1a48df5ec684a0fc0f6bd3ee4119a29954b356cd17bfd7a1bc4daaf7216
b6cbd52f048d0b356f1b67ff2e783860
3MB
Score
10/10
SHA1
SHA256
SHA512
2539e01b0d761b64c4a74da6a2ebe2da85e68214
1949e1a48df5ec684a0fc0f6bd3ee4119a29954b356cd17bfd7a1bc4daaf7216
2b0072427aef5d3ee5a0411309f018b2c6c4b126c6eb2a4f1d996a6e7ced5e8849558a3a6bdce45b41b9c2f98378a610cb8ea24dba5e76edc2756a39340ec2a8
Tags
Signatures
-
Glupteba
-
Glupteba Payload
-
Windows security bypass
Tags
TTPs
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Loads dropped DLL
-
Windows security modification
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Modifies boot configuration data using bcdedit
-
Drops file in System32 directory
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
8/10