glupteba | 643b284c28b7f9e8e70bf2a2dd2de872213118b7e027b1fc0d65c401bef227ad | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

General

Target

643b284c28b7f9e8e70bf2a2dd2de872213118b7e027b1fc0d65c401bef227ad
Size

4.1MB
Sample

231013-qdhntshh9w
MD5

a6379db5b1abbfe8594cca160feceb45
SHA1

24d379bb6367f0ed2af47cbf0466c87fa5971955
SHA256

643b284c28b7f9e8e70bf2a2dd2de872213118b7e027b1fc0d65c401bef227ad
SHA512

68e7628412fa0f5f25787d821d343345e05229687dbf01abd9cb8f17fc65b03014acd5b5a45414d54a25094d19c08ebc3da3b8fe0089b2c9639a72f5a5436082
SSDEEP

98304:vlhp/+MAY8LSBetbsJnYPJay0ram2uVyHV/vsKO4IVa8TY/jpHwrQ:vlT/+M2+BeVsJYPms9vsd3Va8M/jpZ

Score

10^/10

glupteba dropper evasion loader persistence

Static task

static1

Behavioral task

behavioral1

Sample

643b284c28b7f9e8e70bf2a2dd2de872213118b7e027b1fc0d65c401bef227ad.exe

Resource

win10v2004-20230915-en

glupteba dropper evasion loader persistence

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  643b284c28b7f9e8e70bf2a2dd2de872213118b7e027b1fc0d65c401bef227ad
- Size
  
  4.1MB
- MD5
  
  a6379db5b1abbfe8594cca160feceb45
- SHA1
  
  24d379bb6367f0ed2af47cbf0466c87fa5971955
- SHA256
  
  643b284c28b7f9e8e70bf2a2dd2de872213118b7e027b1fc0d65c401bef227ad
- SHA512
  
  68e7628412fa0f5f25787d821d343345e05229687dbf01abd9cb8f17fc65b03014acd5b5a45414d54a25094d19c08ebc3da3b8fe0089b2c9639a72f5a5436082
- SSDEEP
  
  98304:vlhp/+MAY8LSBetbsJnYPJay0ram2uVyHV/vsKO4IVa8TY/jpHwrQ:vlT/+M2+BeVsJYPms9vsd3Va8M/jpZ
Score

10^/10

glupteba dropper evasion loader persistence
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistence

© 2018-2024

Terms | Privacy