glupteba | d9b797282c699ab09d04d23004d396400b746d3f77d9cdf06717264612cfc3b8 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

d9b797282c699ab09d04d23004d396400b746d3f77d9cdf06717264612cfc3b8
Size

4.1MB
Sample

221028-3kcsdacdeq
MD5

9d0d097536426c4b7fdfe8870c9a3030
SHA1

bcee07ec8554868f1d84cf071b739e1bc8a281e9
SHA256

d9b797282c699ab09d04d23004d396400b746d3f77d9cdf06717264612cfc3b8
SHA512

d32cbdd52776f96cfa38e3b95764e26bb5e0bb4d95f4c65f1b5baa7d6a2f195cfb3c68519319d9d0824ec90111eadb2921e88bdab2e299321965f9c368bd60b3
SSDEEP

98304:3UceUavM542lNTQAmo++H8PStL8n0mqmKxvi1Z08H8ri:kP0meBQAm12Kw8n6myvi1P

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

d9b797282c699ab09d04d23004d396400b746d3f77d9cdf06717264612cfc3b8.exe

Resource

win10-20220812-en

glupteba discovery dropper evasion loader persistence trojan

windows10-1703-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  d9b797282c699ab09d04d23004d396400b746d3f77d9cdf06717264612cfc3b8
- Size
  
  4.1MB
- MD5
  
  9d0d097536426c4b7fdfe8870c9a3030
- SHA1
  
  bcee07ec8554868f1d84cf071b739e1bc8a281e9
- SHA256
  
  d9b797282c699ab09d04d23004d396400b746d3f77d9cdf06717264612cfc3b8
- SHA512
  
  d32cbdd52776f96cfa38e3b95764e26bb5e0bb4d95f4c65f1b5baa7d6a2f195cfb3c68519319d9d0824ec90111eadb2921e88bdab2e299321965f9c368bd60b3
- SSDEEP
  
  98304:3UceUavM542lNTQAmo++H8PStL8n0mqmKxvi1Z08H8ri:kP0meBQAm12Kw8n6myvi1P
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojan

© 2018-2025

Terms | Privacy