glupteba | 6265cfd5c9f712dd64500c9270ec6d3007a78f48a7724516ff1abf051cb25826 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

6265cfd5c9f712dd64500c9270ec6d3007a78f48a7724516ff1abf051cb25826
Size

4.2MB
Sample

221012-w2ppyafbhl
MD5

b6434b7f9a145c159b9168b858ab9815
SHA1

9fe640ce3b908aa0c682de87f958863d04bb1f34
SHA256

6265cfd5c9f712dd64500c9270ec6d3007a78f48a7724516ff1abf051cb25826
SHA512

1303f1e50187d19c94e57923c145a4018f45c593190157951310027bea054f5ccb6efc939ec6fd754d54e3f912b08960b0343ca7c9aa8a4db2f02dcea3726525
SSDEEP

98304:ys/3htmV1k8SSk5TWwCSCsOg6Li1yLTw3dP2RQ7SlVRf+K4gkLe9u9:9/w1vrk5TkTKuiKTw3dPS6Sl/f+dTLe8

Score

10^/10

glupteba discovery dropper evasion loader persistence

Static task

static1

Behavioral task

behavioral1

Sample

6265cfd5c9f712dd64500c9270ec6d3007a78f48a7724516ff1abf051cb25826.exe

Resource

win10v2004-20220812-en

glupteba discovery dropper evasion loader persistence

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  6265cfd5c9f712dd64500c9270ec6d3007a78f48a7724516ff1abf051cb25826
- Size
  
  4.2MB
- MD5
  
  b6434b7f9a145c159b9168b858ab9815
- SHA1
  
  9fe640ce3b908aa0c682de87f958863d04bb1f34
- SHA256
  
  6265cfd5c9f712dd64500c9270ec6d3007a78f48a7724516ff1abf051cb25826
- SHA512
  
  1303f1e50187d19c94e57923c145a4018f45c593190157951310027bea054f5ccb6efc939ec6fd754d54e3f912b08960b0343ca7c9aa8a4db2f02dcea3726525
- SSDEEP
  
  98304:ys/3htmV1k8SSk5TWwCSCsOg6Li1yLTw3dP2RQ7SlVRf+K4gkLe9u9:9/w1vrk5TkTKuiKTw3dPS6Sl/f+dTLe8
Score

10^/10

glupteba discovery dropper evasion loader persistence
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistence

© 2018-2025

Terms | Privacy