glupteba | 7f68bd1e3b2b1cf4bd132e82a281d0f711e874643be9118ced0fb57509b932a8 | Triage

Sharing

General

Target

7f68bd1e3b2b1cf4bd132e82a281d0f711e874643be9118ced0fb57509b932a8
Size

4.1MB
Sample

230128-rmpzyafb57
MD5

a34309a58ad150f841d7470ad83f8fed
SHA1

6ba52af600d11ddf5c3fa58c9f4dd695651ac34f
SHA256

7f68bd1e3b2b1cf4bd132e82a281d0f711e874643be9118ced0fb57509b932a8
SHA512

e1f5c19b1277dcee7c577536ba3d644dfc997eca3033c6bbf3d99263a04baf1f643103c8e18175314db09eaddd20c5c679b681cbb4e65349e44087d73408c053
SSDEEP

98304:STSixy5jv8qjBp58unkeuIcUjDtxgrpKCYGBrJvtSb:/ixyVRjWunkeLjqpNYGrY

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Targets

- Target
  
  7f68bd1e3b2b1cf4bd132e82a281d0f711e874643be9118ced0fb57509b932a8
- Size
  
  4.1MB
- MD5
  
  a34309a58ad150f841d7470ad83f8fed
- SHA1
  
  6ba52af600d11ddf5c3fa58c9f4dd695651ac34f
- SHA256
  
  7f68bd1e3b2b1cf4bd132e82a281d0f711e874643be9118ced0fb57509b932a8
- SHA512
  
  e1f5c19b1277dcee7c577536ba3d644dfc997eca3033c6bbf3d99263a04baf1f643103c8e18175314db09eaddd20c5c679b681cbb4e65349e44087d73408c053
- SSDEEP
  
  98304:STSixy5jv8qjBp58unkeuIcUjDtxgrpKCYGBrJvtSb:/ixyVRjWunkeLjqpNYGrY
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan