Overview

overview

10

Static

static

dea5c3515a...80.exe

windows7_x64

10

dea5c3515a...80.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dea5c3515a6ba10a6aaa9bd0f68313dc31c6af750e8d9facb062e5cb214abf80

  • Size

    3.8MB

  • Sample

    220524-yhq5rsahhr

  • MD5

    67528c122b41e16a4278be9576237193

  • SHA1

    f87c1086c1fdc52b825f2b8d51ec900e5bebbba6

  • SHA256

    dea5c3515a6ba10a6aaa9bd0f68313dc31c6af750e8d9facb062e5cb214abf80

  • SHA512

    f7026d36eb810d7cde576b386609153dc02ee1133bda41a07afa27e3e931ffcc9cf4468225ca4239e2361c817b15b87f1d0b1122025a1d7390189c5dda4b77bd

Score
10/10
gluptebadropperevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      dea5c3515a6ba10a6aaa9bd0f68313dc31c6af750e8d9facb062e5cb214abf80

    • Size

      3.8MB

    • MD5

      67528c122b41e16a4278be9576237193

    • SHA1

      f87c1086c1fdc52b825f2b8d51ec900e5bebbba6

    • SHA256

      dea5c3515a6ba10a6aaa9bd0f68313dc31c6af750e8d9facb062e5cb214abf80

    • SHA512

      f7026d36eb810d7cde576b386609153dc02ee1133bda41a07afa27e3e931ffcc9cf4468225ca4239e2361c817b15b87f1d0b1122025a1d7390189c5dda4b77bd

    Score
    10/10
    gluptebadropperevasionloaderpersistencetrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks