Overview

overview

10

Static

static

8

ae7daaeed4...82.exe

windows7-x64

10

ae7daaeed4...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

  • Size

    4.7MB

  • Sample

    220725-ewjs3aece4

  • MD5

    9a232f2047ce830e45c421d4c36314c4

  • SHA1

    949d018bda22adbf77496a90ca7d3520baec4355

  • SHA256

    ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

  • SHA512

    1f84f11ec4aae9d2821226d711f29d330b477ee9891e0b05b14700aac5d5805c130df2bb97e86030b91195942fd987849a65efa1359595944d705c3d67acb20d

Score
10/10
gluptebadropperevasionloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

    • Size

      4.7MB

    • MD5

      9a232f2047ce830e45c421d4c36314c4

    • SHA1

      949d018bda22adbf77496a90ca7d3520baec4355

    • SHA256

      ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

    • SHA512

      1f84f11ec4aae9d2821226d711f29d330b477ee9891e0b05b14700aac5d5805c130df2bb97e86030b91195942fd987849a65efa1359595944d705c3d67acb20d

    Score
    10/10
    gluptebadropperevasionloaderpersistencetrojanupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks