glupteba

General

Target

afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733.zip
Size

1.3MB
Sample

231119-z4f3csce4x
MD5

9cc0c0799d4121edf15f1b95b6f27d1c
SHA1

e138913ffae59f51e9cce939c33dbc27618b98c7
SHA256

e46d1f4197504d15f4c64b15672815829b6803b8016459c99892083fc3bc8792
SHA512

43b9cdffca73ed3aab8fe54496badbab0c5e76bd87cf99b4bc70cb8a98e31150ba4e32e99c7717eab957545c4577a7ed54fb8f094a999cd44cc9db45376717d9
SSDEEP

24576:jEZJx3KFMF79qJQmnwK1V/XMrCoRSOSFRE+RvAZP+RgcX+TECpnQTH8HbhDAB:jEZJxamt9qMK1V/LTOSFRE+R2PYXSpVM

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Extracted

Family

redline

Botnet

pixelfresh

C2

194.49.94.11:80

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Targets

- Target
  
  afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733.exe
- Size
  
  1.4MB
- MD5
  
  06545d2660b4542598943edb73268b27
- SHA1
  
  2bf583ca949eba1c5dbf7a3b0e2a44c2a7e00331
- SHA256
  
  afa1a1360224b51648fe7c1cb3233199f0c9c41605d0a7107dfc050ec4d6c733
- SHA512
  
  9f7f846cb10b52522891a4687d4114c7dda01fba82a8e11fd4b7169c779e5ac8a222617c1af9bd9936108e43db5426b17b74e100a224a97abd2c7a63c61d3646
- SSDEEP
  
  24576:9y0J89DmUCFLBO4Z5MghMbXTeaIs4qnGKNkDglwQlpkOv4iM/v+yK:YPlmUCdZ5T+jeh/UGjDQlpk13+
Score

10^/10

glupteba mystic redline sectoprat smokeloader zgrat @ytlogsbot pixelfresh taiga up3 backdoor paypal discovery dropper evasion infostealer loader persistence phishing rat spyware stealer trojan
- Detect Mystic stealer payload
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral1