glupteba | 32629b86b169b6c1bf49ef6e23724e12dd7474e0c77c76aa56ee4ac348caf907 | Triage

Submit
Reports

Overview

overview

Static

static

1

JC_32629b8...07.exe

windows7-x64

JC_32629b8...07.exe

windows10-2004-x64

Sharing

General

Target

JC_32629b86b169b6c1bf49ef6e23724e12dd7474e0c77c76aa56ee4ac348caf907
Size

4.1MB
Sample

231013-fl8vwagg39
MD5

faaa86da63461d071026b534b451b194
SHA1

07ea16ea42280fe68abbb1eaaebc3d55ebf1963a
SHA256

32629b86b169b6c1bf49ef6e23724e12dd7474e0c77c76aa56ee4ac348caf907
SHA512

27f13110e4cf4c7ac81b0689364fc97c16de4bbc8a0c31932edb3771da79848371f0c9e46acba318cc187fbc80e81995df6e7432f5b6a1283823e199cb27bd23
SSDEEP

98304:R+ASELhSYj9+k3HRZXtJvPMVX9M8kZcoO2wqkeL3O:8vEFEGxhv4y8LoOKL3O

Score

10^/10

glupteba dropper evasion loader upx

Static task

static1

Behavioral task

behavioral1

Sample

JC_32629b86b169b6c1bf49ef6e23724e12dd7474e0c77c76aa56ee4ac348caf907.exe

Resource

win7-20230831-en

glupteba dropper evasion loader upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

JC_32629b86b169b6c1bf49ef6e23724e12dd7474e0c77c76aa56ee4ac348caf907.exe

Resource

win10v2004-20230915-en

glupteba dropper evasion loader

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  JC_32629b86b169b6c1bf49ef6e23724e12dd7474e0c77c76aa56ee4ac348caf907
- Size
  
  4.1MB
- MD5
  
  faaa86da63461d071026b534b451b194
- SHA1
  
  07ea16ea42280fe68abbb1eaaebc3d55ebf1963a
- SHA256
  
  32629b86b169b6c1bf49ef6e23724e12dd7474e0c77c76aa56ee4ac348caf907
- SHA512
  
  27f13110e4cf4c7ac81b0689364fc97c16de4bbc8a0c31932edb3771da79848371f0c9e46acba318cc187fbc80e81995df6e7432f5b6a1283823e199cb27bd23
- SSDEEP
  
  98304:R+ASELhSYj9+k3HRZXtJvPMVX9M8kZcoO2wqkeL3O:8vEFEGxhv4y8LoOKL3O
Score

10^/10

glupteba dropper evasion loader upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies boot configuration data using bcdedit
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderupx

behavioral2

gluptebadropperevasionloader

© 2018-2025

Terms | Privacy