glupteba | 1142d9e5da508c6157c133c0083748cffac4a433989cb7717bea595a5d0ec280 | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-1703-x64

Sharing

Copy URL Twitter E-mail

General

Target

1142d9e5da508c6157c133c0083748cffac4a433989cb7717bea595a5d0ec280
Size

4.2MB
Sample

230820-rr5aesfg68
MD5

0ac512e796c1cde491b45ab283504110
SHA1

0cff55e3479702f31929935df4fc06edb5b3498c
SHA256

1142d9e5da508c6157c133c0083748cffac4a433989cb7717bea595a5d0ec280
SHA512

c4eb5aa141814ba1222e357022d5224106d2d514d0b7552363f1117eb569277082a1fa7e50a0a701b1131042511c1471cf747065a44bf3b15f96462b62c020a3
SSDEEP

98304:WxwgKL2QQu5HfhThEc2cBXMt7yRzdccNZ1bGACjHjbIigYNsrsOrhk:lgKLDT5H1FBs+ZcA1bGACjHjxgYN+ssk

Score

10^/10

glupteba dropper evasion loader persistence rootkit trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

1142d9e5da508c6157c133c0083748cffac4a433989cb7717bea595a5d0ec280.exe

Resource

win10-20230703-en

glupteba dropper evasion loader persistence rootkit trojan upx

windows10-1703-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  1142d9e5da508c6157c133c0083748cffac4a433989cb7717bea595a5d0ec280
- Size
  
  4.2MB
- MD5
  
  0ac512e796c1cde491b45ab283504110
- SHA1
  
  0cff55e3479702f31929935df4fc06edb5b3498c
- SHA256
  
  1142d9e5da508c6157c133c0083748cffac4a433989cb7717bea595a5d0ec280
- SHA512
  
  c4eb5aa141814ba1222e357022d5224106d2d514d0b7552363f1117eb569277082a1fa7e50a0a701b1131042511c1471cf747065a44bf3b15f96462b62c020a3
- SSDEEP
  
  98304:WxwgKL2QQu5HfhThEc2cBXMt7yRzdccNZ1bGACjHjbIigYNsrsOrhk:lgKLDT5H1FBs+ZcA1bGACjHjxgYN+ssk
Score

10^/10

glupteba dropper evasion loader persistence rootkit trojan upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencerootkittrojanupx

© 2018-2025

Terms | Privacy