Overview

overview

10

Static

static

1

2d1e840375...d9.exe

windows7-x64

10

2d1e840375...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d1e840375663849c8cee861c6275abd527cd12596b8f237fa516dbaebf798d9

  • Size

    4.1MB

  • Sample

    231012-v49bpagf57

  • MD5

    b5a41b4d554cd435d877b54b17030e55

  • SHA1

    aaa49226cd4b009a7728a0baabbf5bbb7184d61f

  • SHA256

    2d1e840375663849c8cee861c6275abd527cd12596b8f237fa516dbaebf798d9

  • SHA512

    9d43de38e015388318a9572c85f5a9bd4388884ded2dc5f506af9149205f84f59db06436386fee0cf52c2ff421d30f335ab3ffd6651b3a142c125370df2dca9a

  • SSDEEP

    98304:oiYpD7ABWHfjkisjoq01OQsKrLerxYq0oQODwhuTXBLjlqGJ:URAs/jkisjov1sNrxYqJLDwh0X3F

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

Malware Config

Targets

    • Target

      2d1e840375663849c8cee861c6275abd527cd12596b8f237fa516dbaebf798d9

    • Size

      4.1MB

    • MD5

      b5a41b4d554cd435d877b54b17030e55

    • SHA1

      aaa49226cd4b009a7728a0baabbf5bbb7184d61f

    • SHA256

      2d1e840375663849c8cee861c6275abd527cd12596b8f237fa516dbaebf798d9

    • SHA512

      9d43de38e015388318a9572c85f5a9bd4388884ded2dc5f506af9149205f84f59db06436386fee0cf52c2ff421d30f335ab3ffd6651b3a142c125370df2dca9a

    • SSDEEP

      98304:oiYpD7ABWHfjkisjoq01OQsKrLerxYq0oQODwhuTXBLjlqGJ:URAs/jkisjov1sNrxYqJLDwh0X3F

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Modifies boot configuration data using bcdedit

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks