glupteba | 31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175 | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-1703-x64

Sharing

General

Target

31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175
Size

4.1MB
Sample

230209-qh282add49
MD5

173100d82ac3dbb1150765d3a043271c
SHA1

36ad3575378d0ba93d0d8f490d32f462ffddb5b3
SHA256

31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175
SHA512

7a452b850f5a842f08d7ef055bad54676cbb7cd9cc4487232b937b82f873bb5af37949a29c0442f250d2c0f9d359da0492ab9368c83c545911afaa84b96c47e2
SSDEEP

98304:UgN8QW+qXTin421gmRHd2QObzmTAiiDyrTnW:UgiDRTi4dmR92L3m0BWrTnW

Score

10^/10

glupteba discovery dropper evasion loader persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe

Resource

win10-20220812-en

glupteba discovery dropper evasion loader persistence trojan

windows10-1703-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175
- Size
  
  4.1MB
- MD5
  
  173100d82ac3dbb1150765d3a043271c
- SHA1
  
  36ad3575378d0ba93d0d8f490d32f462ffddb5b3
- SHA256
  
  31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175
- SHA512
  
  7a452b850f5a842f08d7ef055bad54676cbb7cd9cc4487232b937b82f873bb5af37949a29c0442f250d2c0f9d359da0492ab9368c83c545911afaa84b96c47e2
- SSDEEP
  
  98304:UgN8QW+qXTin421gmRHd2QObzmTAiiDyrTnW:UgiDRTi4dmR92L3m0BWrTnW
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojan

© 2018-2025

Terms | Privacy