glupteba | c68bee8db6e6f1d8b5bf640194dda98e98083f19d0bf3d5d87a9e71cd006a49a | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

c68bee8db6e6f1d8b5bf640194dda98e98083f19d0bf3d5d87a9e71cd006a49a
Size

4.1MB
Sample

221007-szs3sscge6
MD5

cbcc157f5f077cbbd8954f588b3799d0
SHA1

5310b8fa561a7786bdbee82645d4295c34736530
SHA256

c68bee8db6e6f1d8b5bf640194dda98e98083f19d0bf3d5d87a9e71cd006a49a
SHA512

a90f9ae5e6613b8230a93795e98d671eb3bcc13d6c1dac61e5b9481bf969472c71bbbe3b003e35e78bfb23382e791097db5f06b99ca9b5c09cc8c65a8ffa32a3
SSDEEP

98304:L/2l1/q6lsa6SEhms31TL5CwUdk5anyu+hzdMqR:T01/qnG45CYbZR

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

c68bee8db6e6f1d8b5bf640194dda98e98083f19d0bf3d5d87a9e71cd006a49a.exe

Resource

win10-20220812-en

glupteba discovery dropper evasion loader persistence trojan upx

windows10-1703-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  c68bee8db6e6f1d8b5bf640194dda98e98083f19d0bf3d5d87a9e71cd006a49a
- Size
  
  4.1MB
- MD5
  
  cbcc157f5f077cbbd8954f588b3799d0
- SHA1
  
  5310b8fa561a7786bdbee82645d4295c34736530
- SHA256
  
  c68bee8db6e6f1d8b5bf640194dda98e98083f19d0bf3d5d87a9e71cd006a49a
- SHA512
  
  a90f9ae5e6613b8230a93795e98d671eb3bcc13d6c1dac61e5b9481bf969472c71bbbe3b003e35e78bfb23382e791097db5f06b99ca9b5c09cc8c65a8ffa32a3
- SSDEEP
  
  98304:L/2l1/q6lsa6SEhms31TL5CwUdk5anyu+hzdMqR:T01/qnG45CYbZR
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojanupx

© 2018-2024

Terms | Privacy