glupteba | 485efde0e891c1fc31bcbf4ba370954eace76ed21ddedcee0ab3a534b93acde7 | Triage

Sharing

General

Target

485efde0e891c1fc31bcbf4ba370954eace76ed21ddedcee0ab3a534b93acde7
Size

4.1MB
Sample

220918-st3eaabdf3
MD5

edb11db6fc83fa3123e53b9c64f08a55
SHA1

19609a1b370963bfa561d31ea2b4850d4a2798c5
SHA256

485efde0e891c1fc31bcbf4ba370954eace76ed21ddedcee0ab3a534b93acde7
SHA512

8f8e547788e809d8578118abd71ae95b12a595dcff3881b730b5cb8086245d4a8ac882cdda43d7247b932178e1f74dcf3415c3f8d9292767ea7b1a69dbd52f1f
SSDEEP

98304:8nTDGR79/XGczYc02HnTg13HrCm/9oZk4m4mSE2fe7J:WTiR71Xjj0BLC8P4fmN2Q

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Targets

- Target
  
  485efde0e891c1fc31bcbf4ba370954eace76ed21ddedcee0ab3a534b93acde7
- Size
  
  4.1MB
- MD5
  
  edb11db6fc83fa3123e53b9c64f08a55
- SHA1
  
  19609a1b370963bfa561d31ea2b4850d4a2798c5
- SHA256
  
  485efde0e891c1fc31bcbf4ba370954eace76ed21ddedcee0ab3a534b93acde7
- SHA512
  
  8f8e547788e809d8578118abd71ae95b12a595dcff3881b730b5cb8086245d4a8ac882cdda43d7247b932178e1f74dcf3415c3f8d9292767ea7b1a69dbd52f1f
- SSDEEP
  
  98304:8nTDGR79/XGczYc02HnTg13HrCm/9oZk4m4mSE2fe7J:WTiR71Xjj0BLC8P4fmN2Q
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan