glupteba | ad0e76726bbbcab62de0a568b99ca03b7a489300d5e383ab0698f8cee962f02c | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

ad0e76726bbbcab62de0a568b99ca03b7a489300d5e383ab0698f8cee962f02c
Size

4.1MB
Sample

220916-ml33ysbbep
MD5

93e209eaeee1783715414e0996900731
SHA1

0c30f25511a748f165ecae21cb62acd93b28ebe9
SHA256

ad0e76726bbbcab62de0a568b99ca03b7a489300d5e383ab0698f8cee962f02c
SHA512

6d4c2e8709b7ce9f18ed41bf6392c227f6cf768c2f47b55d3081dd3185c972704c02be81be1d8501a953fc3c8f31b928d0fe9fb0a9ef881d73093de573ebddc9
SSDEEP

98304:/xOwhBGxqV7zgiHL7o37dvQkWYP963w8zR431mudFxNMnfxO2M:MiBGEFHYt23w89kSOZ

Score

10^/10

glupteba discovery dropper evasion loader persistence upx

Static task

static1

Behavioral task

behavioral1

Sample

ad0e76726bbbcab62de0a568b99ca03b7a489300d5e383ab0698f8cee962f02c.exe

Resource

win10v2004-20220901-en

glupteba discovery dropper evasion loader persistence upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  ad0e76726bbbcab62de0a568b99ca03b7a489300d5e383ab0698f8cee962f02c
- Size
  
  4.1MB
- MD5
  
  93e209eaeee1783715414e0996900731
- SHA1
  
  0c30f25511a748f165ecae21cb62acd93b28ebe9
- SHA256
  
  ad0e76726bbbcab62de0a568b99ca03b7a489300d5e383ab0698f8cee962f02c
- SHA512
  
  6d4c2e8709b7ce9f18ed41bf6392c227f6cf768c2f47b55d3081dd3185c972704c02be81be1d8501a953fc3c8f31b928d0fe9fb0a9ef881d73093de573ebddc9
- SSDEEP
  
  98304:/xOwhBGxqV7zgiHL7o37dvQkWYP963w8zR431mudFxNMnfxO2M:MiBGEFHYt23w89kSOZ
Score

10^/10

glupteba discovery dropper evasion loader persistence upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistenceupx

© 2018-2024

Terms | Privacy