glupteba | ee3c7c9b2bfba92db46b8270a49c65c3d661f3064cb8866d7f5ec25f2c5af1c2 | Triage

Sharing

General

Target

ee3c7c9b2bfba92db46b8270a49c65c3d661f3064cb8866d7f5ec25f2c5af1c2
Size

4.1MB
Sample

220916-fyh5zsegc4
MD5

1a4bcb40af1bb4c1e26878ae271ede1d
SHA1

37bc8495655e783f7db3b6db02e4459ee675d0f5
SHA256

ee3c7c9b2bfba92db46b8270a49c65c3d661f3064cb8866d7f5ec25f2c5af1c2
SHA512

8260e0f808f6315cf89c60243154334bac3da8328a45b2eb98278f1add77e276a8d5fab47f484d93d04da25e37e4f56388a0531ed738c006b629525f589a4c25
SSDEEP

98304:fQjJyFTrdbXEoxca+Tx+tAyFyGgyThpPui74YSEemXWT4ju2X3x:oVyrklx+JFVTht745EtmMzB

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Targets

- Target
  
  ee3c7c9b2bfba92db46b8270a49c65c3d661f3064cb8866d7f5ec25f2c5af1c2
- Size
  
  4.1MB
- MD5
  
  1a4bcb40af1bb4c1e26878ae271ede1d
- SHA1
  
  37bc8495655e783f7db3b6db02e4459ee675d0f5
- SHA256
  
  ee3c7c9b2bfba92db46b8270a49c65c3d661f3064cb8866d7f5ec25f2c5af1c2
- SHA512
  
  8260e0f808f6315cf89c60243154334bac3da8328a45b2eb98278f1add77e276a8d5fab47f484d93d04da25e37e4f56388a0531ed738c006b629525f589a4c25
- SSDEEP
  
  98304:fQjJyFTrdbXEoxca+Tx+tAyFyGgyThpPui74YSEemXWT4ju2X3x:oVyrklx+JFVTht745EtmMzB
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan