glupteba | 4d8c2542c9c2e46ba20411eca88221e43ad39def013eab45a5aa7e7307c802a3 | Triage

Submit
Reports

Overview

overview

Static

static

1

4d8c2542c9...a3.exe

windows7-x64

4d8c2542c9...a3.exe

windows10-2004-x64

Sharing

General

Target

4d8c2542c9c2e46ba20411eca88221e43ad39def013eab45a5aa7e7307c802a3
Size

4.1MB
Sample

231012-flypxaaf54
MD5

737c9fd51fc2c8558eb533fc4c88a7d0
SHA1

d28950b09ebbc483a2d2ad92ff9e94ef1bd8a6c1
SHA256

4d8c2542c9c2e46ba20411eca88221e43ad39def013eab45a5aa7e7307c802a3
SHA512

e04450baa09026b1974534ceb0095220abdf2d4f37461c59f10786b41d89adfed9ed9ccdd89cf814959d3a0ffbbb123451577635309cc295c3a136703c7635f4
SSDEEP

98304:fZvizi9TYcdcmJwy08hZjaU8DpJ/7O248HC1:h6zi9T/CmJwZ8jaU8Dn7O248w

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan

Static task

static1

Behavioral task

behavioral1

Sample

4d8c2542c9c2e46ba20411eca88221e43ad39def013eab45a5aa7e7307c802a3.exe

Resource

win7-20230831-en

glupteba dropper evasion loader persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

4d8c2542c9c2e46ba20411eca88221e43ad39def013eab45a5aa7e7307c802a3.exe

Resource

win10v2004-20230915-en

glupteba discovery dropper evasion loader persistence rootkit

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  4d8c2542c9c2e46ba20411eca88221e43ad39def013eab45a5aa7e7307c802a3
- Size
  
  4.1MB
- MD5
  
  737c9fd51fc2c8558eb533fc4c88a7d0
- SHA1
  
  d28950b09ebbc483a2d2ad92ff9e94ef1bd8a6c1
- SHA256
  
  4d8c2542c9c2e46ba20411eca88221e43ad39def013eab45a5aa7e7307c802a3
- SHA512
  
  e04450baa09026b1974534ceb0095220abdf2d4f37461c59f10786b41d89adfed9ed9ccdd89cf814959d3a0ffbbb123451577635309cc295c3a136703c7635f4
- SSDEEP
  
  98304:fZvizi9TYcdcmJwy08hZjaU8DpJ/7O248HC1:h6zi9T/CmJwZ8jaU8Dn7O248w
Score

10^/10

glupteba dropper evasion loader persistence trojan discovery rootkit
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan

behavioral2

gluptebadiscoverydropperevasionloaderpersistencerootkit

© 2018-2025

Terms | Privacy