Overview

overview

10

Static

static

1

JC_7d8f268...6c.exe

windows7-x64

10

JC_7d8f268...6c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    JC_7d8f2686837a2c8c2ecf4e016fc9e239ed68d2936f5d9d44fe70d62266b3b86c

  • Size

    4.2MB

  • Sample

    231013-c7sh8sbb9v

  • MD5

    4d1cb8d85810d328c58b3380f5eab4e1

  • SHA1

    8428c4c1ecb8c0d88976b7aee9a7351969caa210

  • SHA256

    7d8f2686837a2c8c2ecf4e016fc9e239ed68d2936f5d9d44fe70d62266b3b86c

  • SHA512

    886a9c8502ef0fd481ccce4da8e3919d69df8c8fbd6dee81054ed06c34e688384242394f25b57bbbe85929fe8658d85d40df68673abc22286a2a5093f76a02ea

  • SSDEEP

    98304:07U1XRFHafWZ0eCyNzWbXgxqO0E4jQzQ0bytmxvDUS:jmez1xq3E6QzQ0bRp

Score
10/10
gluptebadropperevasionloaderransomwareupx

Malware Config

Targets

    • Target

      JC_7d8f2686837a2c8c2ecf4e016fc9e239ed68d2936f5d9d44fe70d62266b3b86c

    • Size

      4.2MB

    • MD5

      4d1cb8d85810d328c58b3380f5eab4e1

    • SHA1

      8428c4c1ecb8c0d88976b7aee9a7351969caa210

    • SHA256

      7d8f2686837a2c8c2ecf4e016fc9e239ed68d2936f5d9d44fe70d62266b3b86c

    • SHA512

      886a9c8502ef0fd481ccce4da8e3919d69df8c8fbd6dee81054ed06c34e688384242394f25b57bbbe85929fe8658d85d40df68673abc22286a2a5093f76a02ea

    • SSDEEP

      98304:07U1XRFHafWZ0eCyNzWbXgxqO0E4jQzQ0bytmxvDUS:jmez1xq3E6QzQ0bRp

    Score
    10/10
    gluptebadropperevasionloaderransomwareupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Modifies Windows Firewall

      evasion

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks