Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46
-
Size
4.2MB
-
Sample
230518-ra4bsscb39
-
MD5
11ab111ec46b24ac0e8822e3f1a88ffe
-
SHA1
80ae5ba81f6edab19dd3eefdab3de31ffd252ba0
-
SHA256
e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46
-
SHA512
08b7b061b32de65126bd22c8e04a917332c78e8fb77b660e35ebccf5cdfd5fbd07fb7f76efbb221da0f2cdc5a279aac6a26e8c0749b6dd862a9791da1b7274cb
-
SSDEEP
98304:eRm1FI4Ofs4hghp/MO0myowzLWwPA6QaCj20M9u8R69Afm/Q:km0lfCbR/wzqGAbaCjcQC
Malware Config
Targets
-
-
Target
e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46
-
Size
4.2MB
-
MD5
11ab111ec46b24ac0e8822e3f1a88ffe
-
SHA1
80ae5ba81f6edab19dd3eefdab3de31ffd252ba0
-
SHA256
e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46
-
SHA512
08b7b061b32de65126bd22c8e04a917332c78e8fb77b660e35ebccf5cdfd5fbd07fb7f76efbb221da0f2cdc5a279aac6a26e8c0749b6dd862a9791da1b7274cb
-
SSDEEP
98304:eRm1FI4Ofs4hghp/MO0myowzLWwPA6QaCj20M9u8R69Afm/Q:km0lfCbR/wzqGAbaCjcQC
Score10/10-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload
-
Windows security bypass
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMon driver.
Roottkits write to WinMon to hide PIDs from being detected.
-
Manipulates WinMonFS driver.
Roottkits write to WinMonFS to hide directories/files from being detected.
-