glupteba | 185061d5920ed23ff9a02cb026c6a718cb3f2ebef871cb1b8587da9a64ad0c7d | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

185061d5920ed23ff9a02cb026c6a718cb3f2ebef871cb1b8587da9a64ad0c7d
Size

4.0MB
Sample

221125-l7w14ahg49
MD5

fc6fdbedd8aaded78aa85f64f24c143d
SHA1

c80761746b152afdf4a0252a5e8ed1c662170a39
SHA256

185061d5920ed23ff9a02cb026c6a718cb3f2ebef871cb1b8587da9a64ad0c7d
SHA512

1b3bdc1523bcfcee1751d48fdc9205239bfce1ed29cb28bdc2984f72f885ccf781b561494349821992b5c737a04c3f2d44697b818ccd8a5aeae26e489a94f013
SSDEEP

98304:ZP944/0pK8V0OWeCVU+cMijaYBJ7f47gG6yTkg:ZP930pfVQnoGYBBw2ikg

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

185061d5920ed23ff9a02cb026c6a718cb3f2ebef871cb1b8587da9a64ad0c7d.exe

Resource

win10-20220901-en

glupteba discovery dropper evasion loader persistence trojan upx

windows10-1703-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  185061d5920ed23ff9a02cb026c6a718cb3f2ebef871cb1b8587da9a64ad0c7d
- Size
  
  4.0MB
- MD5
  
  fc6fdbedd8aaded78aa85f64f24c143d
- SHA1
  
  c80761746b152afdf4a0252a5e8ed1c662170a39
- SHA256
  
  185061d5920ed23ff9a02cb026c6a718cb3f2ebef871cb1b8587da9a64ad0c7d
- SHA512
  
  1b3bdc1523bcfcee1751d48fdc9205239bfce1ed29cb28bdc2984f72f885ccf781b561494349821992b5c737a04c3f2d44697b818ccd8a5aeae26e489a94f013
- SSDEEP
  
  98304:ZP944/0pK8V0OWeCVU+cMijaYBJ7f47gG6yTkg:ZP930pfVQnoGYBBw2ikg
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojanupx

© 2018-2024

Terms | Privacy