glupteba | 8506dce2e894bf764b5f3a3f1e31a5417cec38b9d341ad95f3fba31c76774195 | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

General

Target

8506dce2e894bf764b5f3a3f1e31a5417cec38b9d341ad95f3fba31c76774195
Size

4.2MB
Sample

230508-x9e15scd68
MD5

55bd017c8fbf867fe2b3edb27152372f
SHA1

7e4c9c240262ffcec8baee0c38f9eeed704308c8
SHA256

8506dce2e894bf764b5f3a3f1e31a5417cec38b9d341ad95f3fba31c76774195
SHA512

6c34d72e468e4f8a9d83b57ac75bdd15920e7e0af0aeef6dd2aac17e8c4acba39809205716ede72c969488d02bdb0e6d4d7be650b3b70dff97996d9f62fb6ecf
SSDEEP

49152:19mfkEim3+6v6NxV+qwEGFIqD7rFphrOWDZmBMfT5LmhSIA2D2s7Zu6uTFpQ/:u5O6Dq9GF97rNrhmq78h2wd7cE

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Static task

static1

Behavioral task

behavioral1

Sample

8506dce2e894bf764b5f3a3f1e31a5417cec38b9d341ad95f3fba31c76774195.exe

Resource

win10v2004-20230220-en

glupteba discovery dropper evasion loader persistence rootkit upx

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  8506dce2e894bf764b5f3a3f1e31a5417cec38b9d341ad95f3fba31c76774195
- Size
  
  4.2MB
- MD5
  
  55bd017c8fbf867fe2b3edb27152372f
- SHA1
  
  7e4c9c240262ffcec8baee0c38f9eeed704308c8
- SHA256
  
  8506dce2e894bf764b5f3a3f1e31a5417cec38b9d341ad95f3fba31c76774195
- SHA512
  
  6c34d72e468e4f8a9d83b57ac75bdd15920e7e0af0aeef6dd2aac17e8c4acba39809205716ede72c969488d02bdb0e6d4d7be650b3b70dff97996d9f62fb6ecf
- SSDEEP
  
  49152:19mfkEim3+6v6NxV+qwEGFIqD7rFphrOWDZmBMfT5LmhSIA2D2s7Zu6uTFpQ/:u5O6Dq9GF97rNrhmq78h2wd7cE
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkitupx

© 2018-2024

Terms | Privacy