glupteba | 6e87719037a6279feb55f55efebf17589ac68e19964f59670bc82237051289ca | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

General

Target

6e87719037a6279feb55f55efebf17589ac68e19964f59670bc82237051289ca
Size

4.1MB
Sample

230717-sdlftsde8y
MD5

961efacd1741eb68dd4d4cc51d27a73f
SHA1

8cd91644d43d7ffff36e2d9612eee5c02221f631
SHA256

6e87719037a6279feb55f55efebf17589ac68e19964f59670bc82237051289ca
SHA512

25c2c446c1170719ce53a6065c110bf0ab246e2c1afa104d7191256cf4fb4ef33cd19eee37c1265b747b633c1be6ed1a860375fdbc00b1a353eb3aca15aa6914
SSDEEP

49152:8CARxnQoh+SxUjblCCRlt/pBzA17SD0X4gowzBKPpxYPe85xJ5ZlAWPjm/lbuF2J:PmdhPxKBntfeuwJojpvyFsWK/OE

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Static task

static1

Behavioral task

behavioral1

Sample

6e87719037a6279feb55f55efebf17589ac68e19964f59670bc82237051289ca.exe

Resource

win10v2004-20230703-en

glupteba discovery dropper evasion loader persistence rootkit upx

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  6e87719037a6279feb55f55efebf17589ac68e19964f59670bc82237051289ca
- Size
  
  4.1MB
- MD5
  
  961efacd1741eb68dd4d4cc51d27a73f
- SHA1
  
  8cd91644d43d7ffff36e2d9612eee5c02221f631
- SHA256
  
  6e87719037a6279feb55f55efebf17589ac68e19964f59670bc82237051289ca
- SHA512
  
  25c2c446c1170719ce53a6065c110bf0ab246e2c1afa104d7191256cf4fb4ef33cd19eee37c1265b747b633c1be6ed1a860375fdbc00b1a353eb3aca15aa6914
- SSDEEP
  
  49152:8CARxnQoh+SxUjblCCRlt/pBzA17SD0X4gowzBKPpxYPe85xJ5ZlAWPjm/lbuF2J:PmdhPxKBntfeuwJojpvyFsWK/OE
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkitupx

© 2018-2024

Terms | Privacy