glupteba | 83e9698366d83677ce39e15dd7380aa33fe14dd7938d8179b64f50f3095f2c3d | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

General

Target

83e9698366d83677ce39e15dd7380aa33fe14dd7938d8179b64f50f3095f2c3d
Size

4.1MB
Sample

230307-fjn3pagc9w
MD5

ceb80279c120fe38b42bbb922ea21a80
SHA1

28066a0362a94a0e21e632d92606445afa4f6f6b
SHA256

83e9698366d83677ce39e15dd7380aa33fe14dd7938d8179b64f50f3095f2c3d
SHA512

af8dc90757437152be9e889e482b1bda0e4f0d47e66e3809f376dcd8467774470c66ef979a314167ad0e5b3177cdfb2c12b5e02fec7cfc34261b8d542181331b
SSDEEP

98304:o22p4QQlCmWSK8PDcEHgxmFKqsO+da+HcqT3r5kpzXQ:B2p453AEAsFKqWa+8qT3r56Q

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit

Static task

static1

Behavioral task

behavioral1

Sample

83e9698366d83677ce39e15dd7380aa33fe14dd7938d8179b64f50f3095f2c3d.exe

Resource

win10v2004-20230220-en

glupteba discovery dropper evasion loader persistence rootkit

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  83e9698366d83677ce39e15dd7380aa33fe14dd7938d8179b64f50f3095f2c3d
- Size
  
  4.1MB
- MD5
  
  ceb80279c120fe38b42bbb922ea21a80
- SHA1
  
  28066a0362a94a0e21e632d92606445afa4f6f6b
- SHA256
  
  83e9698366d83677ce39e15dd7380aa33fe14dd7938d8179b64f50f3095f2c3d
- SHA512
  
  af8dc90757437152be9e889e482b1bda0e4f0d47e66e3809f376dcd8467774470c66ef979a314167ad0e5b3177cdfb2c12b5e02fec7cfc34261b8d542181331b
- SSDEEP
  
  98304:o22p4QQlCmWSK8PDcEHgxmFKqsO+da+HcqT3r5kpzXQ:B2p453AEAsFKqWa+8qT3r56Q
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Web Service

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkit

© 2018-2025

Terms | Privacy