glupteba | 9309f08c3bcd4ded505af2c2c1a2bdbe8fec38eeb9e36ae8dd526252b2eb6b2c | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

9309f08c3bcd4ded505af2c2c1a2bdbe8fec38eeb9e36ae8dd526252b2eb6b2c
Size

4.1MB
Sample

221010-qezczabhc5
MD5

887e2642f034172c9e223a01d7d120dc
SHA1

f650e971d6943b381d758c95f9c970005351fb6e
SHA256

9309f08c3bcd4ded505af2c2c1a2bdbe8fec38eeb9e36ae8dd526252b2eb6b2c
SHA512

f2cab3f5f5b089e5776ba0faff1d65d0f1def034040b371673e162fd9bdb699951481488c98257077371cdc21a3e20fd8c2a26b263cf970cc9041142e7a4b542
SSDEEP

98304:YLI/ZiKerk8rKFHGAlXE7mdJAGjbOvtpKoLGdstz9h8Ggibv8rGu:wI/dkkjtGAe6evtpKo4iz9rgiorGu

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

9309f08c3bcd4ded505af2c2c1a2bdbe8fec38eeb9e36ae8dd526252b2eb6b2c.exe

Resource

win10-20220812-en

glupteba discovery dropper evasion loader persistence trojan

windows10-1703-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  9309f08c3bcd4ded505af2c2c1a2bdbe8fec38eeb9e36ae8dd526252b2eb6b2c
- Size
  
  4.1MB
- MD5
  
  887e2642f034172c9e223a01d7d120dc
- SHA1
  
  f650e971d6943b381d758c95f9c970005351fb6e
- SHA256
  
  9309f08c3bcd4ded505af2c2c1a2bdbe8fec38eeb9e36ae8dd526252b2eb6b2c
- SHA512
  
  f2cab3f5f5b089e5776ba0faff1d65d0f1def034040b371673e162fd9bdb699951481488c98257077371cdc21a3e20fd8c2a26b263cf970cc9041142e7a4b542
- SSDEEP
  
  98304:YLI/ZiKerk8rKFHGAlXE7mdJAGjbOvtpKoLGdstz9h8Ggibv8rGu:wI/dkkjtGAe6evtpKo4iz9rgiorGu
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojan

© 2018-2024

Terms | Privacy