glupteba | f3ba376d64b68e0d5d378af7b65df085b55747da5cdd3c46240581b623da1d18 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

f3ba376d64b68e0d5d378af7b65df085b55747da5cdd3c46240581b623da1d18
Size

4.1MB
Sample

220915-j7kxqacdd5
MD5

a597acd7289691a729239aec874de648
SHA1

0c1a0fbc7e94d6d26c2f1dbc7bd9193de90e153e
SHA256

f3ba376d64b68e0d5d378af7b65df085b55747da5cdd3c46240581b623da1d18
SHA512

31b47b3ffd2d798615bd7a872f3055d49b707394fb16813e9b6881851711f52fc700edba39f5e84d3a32ddff42c5df4b90771b76d73ad3c06c8982fa1b938d2d
SSDEEP

98304:c7K7QhYvVa3Qu0pcoCUpQw/0FNRIQWMhT4p7XsvmldViNR/EZqEX:ekvVa3Qu0pysH0FgQEqmldwNhEZfX

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

f3ba376d64b68e0d5d378af7b65df085b55747da5cdd3c46240581b623da1d18.exe

Resource

win10-20220812-en

glupteba discovery dropper evasion loader persistence trojan

windows10-1703-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  f3ba376d64b68e0d5d378af7b65df085b55747da5cdd3c46240581b623da1d18
- Size
  
  4.1MB
- MD5
  
  a597acd7289691a729239aec874de648
- SHA1
  
  0c1a0fbc7e94d6d26c2f1dbc7bd9193de90e153e
- SHA256
  
  f3ba376d64b68e0d5d378af7b65df085b55747da5cdd3c46240581b623da1d18
- SHA512
  
  31b47b3ffd2d798615bd7a872f3055d49b707394fb16813e9b6881851711f52fc700edba39f5e84d3a32ddff42c5df4b90771b76d73ad3c06c8982fa1b938d2d
- SSDEEP
  
  98304:c7K7QhYvVa3Qu0pcoCUpQw/0FNRIQWMhT4p7XsvmldViNR/EZqEX:ekvVa3Qu0pysH0FgQEqmldwNhEZfX
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojan

© 2018-2024

Terms | Privacy