glupteba | 3d8b15c519a1da4b3c9baf36a7f50e999b6e4c157f8de155a049d42972761a19 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

General

Target

3d8b15c519a1da4b3c9baf36a7f50e999b6e4c157f8de155a049d42972761a19
Size

4.1MB
Sample

230425-jp8wtshc25
MD5

e6d20dece0b693818ed8a13a659c17aa
SHA1

7e61a96b6a78edd9d90728f8cab46d8cfc8a72ff
SHA256

3d8b15c519a1da4b3c9baf36a7f50e999b6e4c157f8de155a049d42972761a19
SHA512

531720e4ebfd0c19a80c18da3bdfdf9951c88537247033faafb2d166457252ade554e0e4135bae44d9fbcd48c97a6d2e481079594529b1cb71f593ee494ca18b
SSDEEP

98304:7cDvP7H6DwCBSIGMcSuOCAvnY2Ytt0zGRM1:71DwC0IHzY2YttEr

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Static task

static1

Behavioral task

behavioral1

Sample

3d8b15c519a1da4b3c9baf36a7f50e999b6e4c157f8de155a049d42972761a19.exe

Resource

win10v2004-20230220-en

glupteba discovery dropper evasion loader persistence rootkit upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  3d8b15c519a1da4b3c9baf36a7f50e999b6e4c157f8de155a049d42972761a19
- Size
  
  4.1MB
- MD5
  
  e6d20dece0b693818ed8a13a659c17aa
- SHA1
  
  7e61a96b6a78edd9d90728f8cab46d8cfc8a72ff
- SHA256
  
  3d8b15c519a1da4b3c9baf36a7f50e999b6e4c157f8de155a049d42972761a19
- SHA512
  
  531720e4ebfd0c19a80c18da3bdfdf9951c88537247033faafb2d166457252ade554e0e4135bae44d9fbcd48c97a6d2e481079594529b1cb71f593ee494ca18b
- SSDEEP
  
  98304:7cDvP7H6DwCBSIGMcSuOCAvnY2Ytt0zGRM1:71DwC0IHzY2YttEr
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkitupx

© 2018-2025

Terms | Privacy