glupteba

General

Target

30befd088724719df66035cff6175ec647a4e80ec049eb84ba0a769e08c9e60c.zip
Size

755KB
Sample

231119-1bawbace9s
MD5

4a35d5b730e91ca50d22afdf361d1bec
SHA1

785380770a94419189941c6f46e8e4f79be2d239
SHA256

861bd76fab868f3be964df98bc5c59cd25e187115738efecac98c8b2215c40a0
SHA512

19725ab814b8bd5785822b51f645cceb8de8ec5764a51eac3560a2d4a5c336bb466d2b26e15b13baeb84074a7c1c15ddc8754c6961fbecf9321edbf056631589
SSDEEP

12288:ltQFl6QlmwEQjUgg1bDa8tQ9K0yI7SfNysNKAGMb5Lnh9qd3Ig/lHNBSSazD+:ltQIke1a+YsNKA/b5Lh9qlDHNBXae

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

pixelfresh

C2

194.49.94.11:80

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Targets

- Target
  
  30befd088724719df66035cff6175ec647a4e80ec049eb84ba0a769e08c9e60c.exe
- Size
  
  799KB
- MD5
  
  06e964d72a34dc9e1cc80e3a8fe9bdeb
- SHA1
  
  58f6a85a578901f1fa64ac9598e47eb121836843
- SHA256
  
  30befd088724719df66035cff6175ec647a4e80ec049eb84ba0a769e08c9e60c
- SHA512
  
  59ceec8e5aa6453ecf8e6fae57251f88a07ad9b34665143c648e252a6f0af75479a5607839bb0a89621938d0afc340c37778b383a431b586ea4f1412304f1bfb
- SSDEEP
  
  24576:ry5rqmZj5AaeuIseC/GRLYDHILx4wqMwFY:e5rNZ9ZetJEGK0F49
Score

10^/10

glupteba mystic redline sectoprat smokeloader zgrat @ytlogsbot pixelfresh up3 backdoor microsoft paypal discovery dropper evasion infostealer loader persistence phishing rat spyware stealer trojan
- Detect Mystic stealer payload
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral1