Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8c59cea2a091b26c5425abff05bd9cbd49de05cc852148048f81e86bdd6a3a96
-
Size
4.2MB
-
Sample
230525-186dgsdd2s
-
MD5
04baaac6f3c193fb50667bc8059af2b5
-
SHA1
d0fa425a72f8ed45ade70b2bb646842523d8d0f9
-
SHA256
8c59cea2a091b26c5425abff05bd9cbd49de05cc852148048f81e86bdd6a3a96
-
SHA512
0bc3787653dc2c1a2fb11d2c9c0f65e0f967c38c1152d7e412c85bb395aff6bc4d59dc28e4cdda85c40fa0c7a16f40c01965c919384bb3998a2f06603066c68b
-
SSDEEP
98304:c9zsQ68NZJAUQvS0gtKx7M125D/72Q5Z9pvPsrDHphmEIUQTk:c9zDHXJT0SKx71Dj2SnqJNp3
Malware Config
Targets
-
-
Target
8c59cea2a091b26c5425abff05bd9cbd49de05cc852148048f81e86bdd6a3a96
-
Size
4.2MB
-
MD5
04baaac6f3c193fb50667bc8059af2b5
-
SHA1
d0fa425a72f8ed45ade70b2bb646842523d8d0f9
-
SHA256
8c59cea2a091b26c5425abff05bd9cbd49de05cc852148048f81e86bdd6a3a96
-
SHA512
0bc3787653dc2c1a2fb11d2c9c0f65e0f967c38c1152d7e412c85bb395aff6bc4d59dc28e4cdda85c40fa0c7a16f40c01965c919384bb3998a2f06603066c68b
-
SSDEEP
98304:c9zsQ68NZJAUQvS0gtKx7M125D/72Q5Z9pvPsrDHphmEIUQTk:c9zDHXJT0SKx71Dj2SnqJNp3
Score10/10-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload
-
Windows security bypass
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMon driver.
Roottkits write to WinMon to hide PIDs from being detected.
-
Manipulates WinMonFS driver.
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory
-