glupteba

Sharing

Copy URL

Twitter E-mail

General

Target

afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733.zip
Size

1.3MB
Sample

231119-3jycpade2v
MD5

9f6bd2543bcdc4566d9f337c1ca0e250
SHA1

85290076bf7941aef1564369db1f3d9f7372f7c4
SHA256

d26a9709d67ba276379e3f0aaeeced122423e2e791600d3e70ae3630c15fc003
SHA512

94cb480cc5d31a25df6fcb6a0e15a55261cc442bad279f37e0b8c1c3de37fba082891756ed78e3ed1958f8cdf89ea1c1abe70473dc7bf20edf870b6e83a635bf
SSDEEP

24576:kVOu/Mk05ZMyePh+OYPVCLQTLDWuj9LTPlRykdJzDCEV4cyySJzhsiaWqVFxEh5u:kV3aZJePuPfWC5yEzOqnkhsVrn

Malware Config

Extracted

Family

smokeloader

Version

2022

http://5.42.92.190/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Extracted

Family

redline

Botnet

pixelfresh

194.49.94.11:80

Extracted

Family

redline

Botnet

@ytlogsbot

194.169.175.235:42691

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

195.10.205.16:1056

Targets

- Target
  
  afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733.exe
- Size
  
  1.4MB
- MD5
  
  06545d2660b4542598943edb73268b27
- SHA1
  
  2bf583ca949eba1c5dbf7a3b0e2a44c2a7e00331
- SHA256
  
  afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733
- SHA512
  
  9f7f846cb10b52522891a4687d4114c7dda01fba82a8e11fd4b7169c779e5ac8a222617c1af9bd9936108e43db5426b17b74e100a224a97abd2c7a63c61d3646
- SSDEEP
  
  24576:9y0J89DmUCFLBO4Z5MghMbXTeaIs4qnGKNkDglwQlpkOv4iM/v+yK:YPlmUCdZ5T+jeh/UGjDQlpk13+
Score

10^/10

glupteba mystic redline sectoprat smokeloader @ytlogsbot livetraffic pixelfresh taiga up3 backdoor paypal discovery dropper evasion infostealer loader persistence phishing rat spyware stealer trojan
- Detect Mystic stealer payload
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1