glupteba | cb27ca8f144ee57662eac1f869eae52ea032b9e7e5fa57c7bfe2316e0995fd47 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

cb27ca8f144ee57662eac1f869eae52ea032b9e7e5fa57c7bfe2316e0995fd47
Size

4.1MB
Sample

220916-anxyhaech8
MD5

376adf3b5f7930ac4c1c5a13f2189984
SHA1

ce6be1ab24ca0b54da0d3de49538c193e06335d2
SHA256

cb27ca8f144ee57662eac1f869eae52ea032b9e7e5fa57c7bfe2316e0995fd47
SHA512

cad7965881ea020b90512ff40ea5a046d11de9fdf627fb27b30c23c8a7425a3656ad9dbeb2905ac57bfea7f8158995dbe0727b0767575b0f79df756e7135d05a
SSDEEP

98304:HR7uG50AcPu2PB1NYR41Bt29gAONzPTxFgQLCCQ6Z+SuhV:tuGQGg1NFt26AkzfgdCq

Score

10^/10

glupteba discovery dropper evasion loader persistence upx

Static task

static1

Behavioral task

behavioral1

Sample

cb27ca8f144ee57662eac1f869eae52ea032b9e7e5fa57c7bfe2316e0995fd47.exe

Resource

win10v2004-20220901-en

glupteba discovery dropper evasion loader persistence upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  cb27ca8f144ee57662eac1f869eae52ea032b9e7e5fa57c7bfe2316e0995fd47
- Size
  
  4.1MB
- MD5
  
  376adf3b5f7930ac4c1c5a13f2189984
- SHA1
  
  ce6be1ab24ca0b54da0d3de49538c193e06335d2
- SHA256
  
  cb27ca8f144ee57662eac1f869eae52ea032b9e7e5fa57c7bfe2316e0995fd47
- SHA512
  
  cad7965881ea020b90512ff40ea5a046d11de9fdf627fb27b30c23c8a7425a3656ad9dbeb2905ac57bfea7f8158995dbe0727b0767575b0f79df756e7135d05a
- SSDEEP
  
  98304:HR7uG50AcPu2PB1NYR41Bt29gAONzPTxFgQLCCQ6Z+SuhV:tuGQGg1NFt26AkzfgdCq
Score

10^/10

glupteba discovery dropper evasion loader persistence upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistenceupx

© 2018-2024

Terms | Privacy