glupteba | 3786f83ad4fd33dec42e49a0c9af15c3dcef52120d6b3ca8c0714f8c21db507d | Triage

Sharing

General

Target

3786f83ad4fd33dec42e49a0c9af15c3dcef52120d6b3ca8c0714f8c21db507d
Size

4.1MB
Sample

230128-rqaz7agf21
MD5

3f02938c16cd1d97b50df790eea80172
SHA1

1047e8cb123a2898eea6aa75d8878d572a04afd9
SHA256

3786f83ad4fd33dec42e49a0c9af15c3dcef52120d6b3ca8c0714f8c21db507d
SHA512

234e2174a75998a49da998b93e7c60a35102f2a73c281649cdaafa4aa083838f66f77cce05a35dd32ff617c35260dea8cd177d2aa7fbc9a896049b9ac0b35ef3
SSDEEP

98304:STSixy5jv8qjBp58unkeuIcUjDtxgrpKCYGBrJvK:/ixyVRjWunkeLjqpNYGrE

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Targets

- Target
  
  3786f83ad4fd33dec42e49a0c9af15c3dcef52120d6b3ca8c0714f8c21db507d
- Size
  
  4.1MB
- MD5
  
  3f02938c16cd1d97b50df790eea80172
- SHA1
  
  1047e8cb123a2898eea6aa75d8878d572a04afd9
- SHA256
  
  3786f83ad4fd33dec42e49a0c9af15c3dcef52120d6b3ca8c0714f8c21db507d
- SHA512
  
  234e2174a75998a49da998b93e7c60a35102f2a73c281649cdaafa4aa083838f66f77cce05a35dd32ff617c35260dea8cd177d2aa7fbc9a896049b9ac0b35ef3
- SSDEEP
  
  98304:STSixy5jv8qjBp58unkeuIcUjDtxgrpKCYGBrJvK:/ixyVRjWunkeLjqpNYGrE
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan