glupteba | 770575551e535787acf86c67a5a03dc4e278ee1806fbacfbce7250e1c585539d | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

770575551e535787acf86c67a5a03dc4e278ee1806fbacfbce7250e1c585539d
Size

4.1MB
Sample

230319-17jhbscd8y
MD5

cb643b18e16d73f6ccb585bde07442b0
SHA1

16cc850176c67edcc5e6fbd98e79c7a58a34e0f9
SHA256

770575551e535787acf86c67a5a03dc4e278ee1806fbacfbce7250e1c585539d
SHA512

d2b95c7f0094c67fcfa3d81f39e51958d1b56b7557b5790621b5748abbaaf3955ffcca31debb5985d60dd16b1f0e4ba8e30a07108d49f2c7e783e286ce2bd4cf
SSDEEP

49152:a/pHutSjj/FX6725Lm+e1Df2y3u6r7AOQlL1M2+a4pwxQnz6Yydw6LyxmEVEcLvB:a/puaUN3u6QUdDcdPGxRG5hksjE4YVN3

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit

Static task

static1

Behavioral task

behavioral1

Sample

770575551e535787acf86c67a5a03dc4e278ee1806fbacfbce7250e1c585539d.exe

Resource

win10v2004-20230220-en

glupteba discovery dropper evasion loader persistence rootkit

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  770575551e535787acf86c67a5a03dc4e278ee1806fbacfbce7250e1c585539d
- Size
  
  4.1MB
- MD5
  
  cb643b18e16d73f6ccb585bde07442b0
- SHA1
  
  16cc850176c67edcc5e6fbd98e79c7a58a34e0f9
- SHA256
  
  770575551e535787acf86c67a5a03dc4e278ee1806fbacfbce7250e1c585539d
- SHA512
  
  d2b95c7f0094c67fcfa3d81f39e51958d1b56b7557b5790621b5748abbaaf3955ffcca31debb5985d60dd16b1f0e4ba8e30a07108d49f2c7e783e286ce2bd4cf
- SSDEEP
  
  49152:a/pHutSjj/FX6725Lm+e1Df2y3u6r7AOQlL1M2+a4pwxQnz6Yydw6LyxmEVEcLvB:a/puaUN3u6QUdDcdPGxRG5hksjE4YVN3
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkit

© 2018-2025

Terms | Privacy