Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

JC_0adb6b8...5b.exe

windows7-x64

10

JC_0adb6b8...5b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JC_0adb6b81ba29e9af88245661e0e36a99084846d4e9c098027c5be5400bf5595b

  • Size

    4.2MB

  • Sample

    231013-yvz87sfg8w

  • MD5

    c4895a2e1f79f30bc392a9f8fc061570

  • SHA1

    445c9b4e3365ee22b5a1e9be80e599d43f1f716b

  • SHA256

    0adb6b81ba29e9af88245661e0e36a99084846d4e9c098027c5be5400bf5595b

  • SHA512

    ae448020e609aa2972204c53935f24a008da3a0e0b075173c7c29c167778f5df22ef63056fa06c123943753583dfd40e6501f26711da0369f5ca625253c4c0f7

  • SSDEEP

    98304:BrC9VIcC2BmD4fGBXhOVwfl1jgba7eNZHtqa68OWJOKa6lXcU:AG28WMU2l1oa7eNZx68pJOQRt

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      JC_0adb6b81ba29e9af88245661e0e36a99084846d4e9c098027c5be5400bf5595b

    • Size

      4.2MB

    • MD5

      c4895a2e1f79f30bc392a9f8fc061570

    • SHA1

      445c9b4e3365ee22b5a1e9be80e599d43f1f716b

    • SHA256

      0adb6b81ba29e9af88245661e0e36a99084846d4e9c098027c5be5400bf5595b

    • SHA512

      ae448020e609aa2972204c53935f24a008da3a0e0b075173c7c29c167778f5df22ef63056fa06c123943753583dfd40e6501f26711da0369f5ca625253c4c0f7

    • SSDEEP

      98304:BrC9VIcC2BmD4fGBXhOVwfl1jgba7eNZHtqa68OWJOKa6lXcU:AG28WMU2l1oa7eNZx68pJOQRt

    Score
    10/10
    gluptebadropperevasionloaderupxdiscoverypersistencerootkit

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies boot configuration data using bcdedit

    • Modifies Windows Firewall

      evasion

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks