glupteba | 11b2f56d212b371ee16697f0dd4aa322ba27962251b643e383e44a0ecc526afa | Triage

Sharing

General

Target

11b2f56d212b371ee16697f0dd4aa322ba27962251b643e383e44a0ecc526afa
Size

4.1MB
Sample

220913-jt6l9sfaf2
MD5

a32fa374368a7a615542db4a739eac21
SHA1

db39900cd1c6787d2b5dde76c6cb235011314eda
SHA256

11b2f56d212b371ee16697f0dd4aa322ba27962251b643e383e44a0ecc526afa
SHA512

b86f6a044b5728f39b925b29876f969790006bc9410748cec89abb8948fc34b7cd0a40824b875600196b594f5273de94b3672bcf589adc19da2291bc10477a05
SSDEEP

98304:wRQn3kzYpzOmvMKXh0zVMlpa5cKI8/abTpqmBA:cMcKzvx0zylpa5nItUmBA

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Targets

- Target
  
  11b2f56d212b371ee16697f0dd4aa322ba27962251b643e383e44a0ecc526afa
- Size
  
  4.1MB
- MD5
  
  a32fa374368a7a615542db4a739eac21
- SHA1
  
  db39900cd1c6787d2b5dde76c6cb235011314eda
- SHA256
  
  11b2f56d212b371ee16697f0dd4aa322ba27962251b643e383e44a0ecc526afa
- SHA512
  
  b86f6a044b5728f39b925b29876f969790006bc9410748cec89abb8948fc34b7cd0a40824b875600196b594f5273de94b3672bcf589adc19da2291bc10477a05
- SSDEEP
  
  98304:wRQn3kzYpzOmvMKXh0zVMlpa5cKI8/abTpqmBA:cMcKzvx0zylpa5nItUmBA
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan