glupteba

General

Target

afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733.zip
Size

1.3MB
Sample

231119-1lbklabh97
MD5

8bd002cf121d9b8874013fe7233d0794
SHA1

8e04d5eb025eee835f2c654315ce91b4892a7b38
SHA256

f6a66e3908e9e6d83ee7f8e694f2027a857d09253200c2eefa3461f1fe625968
SHA512

31830a212896a552b34d378b9e44733fb57ee20d297ad7886973749cde276ffb86b524601fd35023fd6ce4f31b21350d45d1d1f52ef2b214bd358c152f199985
SSDEEP

24576:NN1dhlLBiX5B1Nk1wHeKJ3tvtA9ND+THP+ejmU+XYkA/1wtWTGEShW:P1DlLBiXZ8mfRg4H2eAXYH/1wMGEAW

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Extracted

Family

redline

Botnet

pixelfresh

C2

194.49.94.11:80

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Targets

- Target
  
  afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733.exe
- Size
  
  1.4MB
- MD5
  
  06545d2660b4542598943edb73268b27
- SHA1
  
  2bf583ca949eba1c5dbf7a3b0e2a44c2a7e00331
- SHA256
  
  afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733
- SHA512
  
  9f7f846cb10b52522891a4687d4114c7dda01fba82a8e11fd4b7169c779e5ac8a222617c1af9bd9936108e43db5426b17b74e100a224a97abd2c7a63c61d3646
- SSDEEP
  
  24576:9y0J89DmUCFLBO4Z5MghMbXTeaIs4qnGKNkDglwQlpkOv4iM/v+yK:YPlmUCdZ5T+jeh/UGjDQlpk13+
Score

10^/10

glupteba mystic redline sectoprat smokeloader @ytlogsbot pixelfresh taiga up3 backdoor dropper evasion infostealer loader persistence rat stealer trojan
- Detect Mystic stealer payload
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1