glupteba | dab1cdfff06dd63d42d0917c0b304ef5f45546de99b46fb04910fdc5dd8b0ee0 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

dab1cdfff06dd63d42d0917c0b304ef5f45546de99b46fb04910fdc5dd8b0ee0
Size

4.2MB
Sample

221012-ev749scdb6
MD5

9f1ab1a21b49b45fcb5f71d99bc40221
SHA1

b7396dbbeb861bb715323ddabb80a0c67175d43c
SHA256

dab1cdfff06dd63d42d0917c0b304ef5f45546de99b46fb04910fdc5dd8b0ee0
SHA512

a2a7087f325b82db6834cabc28a36ee0275e4a71e941bd6dbf948b738afd27e5cc4b035b29fd11c3032547fc9f8ee2b1c524adb230fafaaf7901ad3358a6c098
SSDEEP

98304:opcVLEdbspnTRwtTiVXfkaqPz5teYjfUzuoRTwEWVL:miLYYBT6tTyfkaqPz5teush0VL

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

dab1cdfff06dd63d42d0917c0b304ef5f45546de99b46fb04910fdc5dd8b0ee0.exe

Resource

win10-20220812-en

glupteba discovery dropper evasion loader persistence trojan upx

windows10-1703-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  dab1cdfff06dd63d42d0917c0b304ef5f45546de99b46fb04910fdc5dd8b0ee0
- Size
  
  4.2MB
- MD5
  
  9f1ab1a21b49b45fcb5f71d99bc40221
- SHA1
  
  b7396dbbeb861bb715323ddabb80a0c67175d43c
- SHA256
  
  dab1cdfff06dd63d42d0917c0b304ef5f45546de99b46fb04910fdc5dd8b0ee0
- SHA512
  
  a2a7087f325b82db6834cabc28a36ee0275e4a71e941bd6dbf948b738afd27e5cc4b035b29fd11c3032547fc9f8ee2b1c524adb230fafaaf7901ad3358a6c098
- SSDEEP
  
  98304:opcVLEdbspnTRwtTiVXfkaqPz5teYjfUzuoRTwEWVL:miLYYBT6tTyfkaqPz5teush0VL
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojanupx

© 2018-2024

Terms | Privacy