glupteba | 502ff855b0f8217bf76954624c446c0d7d4e89349c22c8ff2440dbbfe86031ff | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-1703-x64

Sharing

General

Target

502ff855b0f8217bf76954624c446c0d7d4e89349c22c8ff2440dbbfe86031ff
Size

4.1MB
Sample

230329-1as1habf21
MD5

f9aa886fe02f857d7888086b13544309
SHA1

f87b4eedd5154cf5e8ac711ce8c6c56aeaf20b04
SHA256

502ff855b0f8217bf76954624c446c0d7d4e89349c22c8ff2440dbbfe86031ff
SHA512

e8308950f14a594e31775452654ffa0879b5dc8ee1bd838886c2011e9479782e78740c981524d23396c387ad7fd085915d3e15539a2317cc4db381a1ea2fbf07
SSDEEP

98304:j1nNaYEaCOUIf9xJUVtMrBR0vBXQbkhPhgFBDIGR:qYEWz9xWVoRQBXbSFFIGR

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan

Static task

static1

Behavioral task

behavioral1

Sample

502ff855b0f8217bf76954624c446c0d7d4e89349c22c8ff2440dbbfe86031ff.exe

Resource

win10-20230220-en

glupteba discovery dropper evasion loader persistence rootkit trojan

windows10-1703-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  502ff855b0f8217bf76954624c446c0d7d4e89349c22c8ff2440dbbfe86031ff
- Size
  
  4.1MB
- MD5
  
  f9aa886fe02f857d7888086b13544309
- SHA1
  
  f87b4eedd5154cf5e8ac711ce8c6c56aeaf20b04
- SHA256
  
  502ff855b0f8217bf76954624c446c0d7d4e89349c22c8ff2440dbbfe86031ff
- SHA512
  
  e8308950f14a594e31775452654ffa0879b5dc8ee1bd838886c2011e9479782e78740c981524d23396c387ad7fd085915d3e15539a2317cc4db381a1ea2fbf07
- SSDEEP
  
  98304:j1nNaYEaCOUIf9xJUVtMrBR0vBXQbkhPhgFBDIGR:qYEWz9xWVoRQBXbSFFIGR
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

© 2018-2024

Terms | Privacy