glupteba

General

Target

66b26bce6fd3fa8083cf91c4973580e409488ac0a4d0543a9300cbb32b373442
Size

1.7MB
Sample

231129-sw8zvahd37
MD5

54f592d2d1af8f8d0dc344c6b10e5820
SHA1

f3e68b68b6ec9bad69c84fc3955eb8e711d9716c
SHA256

66b26bce6fd3fa8083cf91c4973580e409488ac0a4d0543a9300cbb32b373442
SHA512

aff2ece452c80195f84307c4d712f1d38fe35999317d2374b216a9284e7655431168966dca97b48172c239811b93bacf9b54eecfb7189d5ed220cf51347e5906
SSDEEP

49152:9I9jrwsOoVdtJSIkFAUCtO6E+k/OF8dpjMMLRp00p+Q:+aGcpiIqNwIMLRpN

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Extracted

Family

redline

Botnet

horda

C2

194.49.94.152:19053

Extracted

Family

smokeloader

Version

2022

C2

http://194.49.94.210/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTraffic

C2

195.10.205.16:2245

Extracted

Family

smokeloader

Botnet

up3

Targets

- Target
  
  66b26bce6fd3fa8083cf91c4973580e409488ac0a4d0543a9300cbb32b373442
- Size
  
  1.7MB
- MD5
  
  54f592d2d1af8f8d0dc344c6b10e5820
- SHA1
  
  f3e68b68b6ec9bad69c84fc3955eb8e711d9716c
- SHA256
  
  66b26bce6fd3fa8083cf91c4973580e409488ac0a4d0543a9300cbb32b373442
- SHA512
  
  aff2ece452c80195f84307c4d712f1d38fe35999317d2374b216a9284e7655431168966dca97b48172c239811b93bacf9b54eecfb7189d5ed220cf51347e5906
- SSDEEP
  
  49152:9I9jrwsOoVdtJSIkFAUCtO6E+k/OF8dpjMMLRp00p+Q:+aGcpiIqNwIMLRpN
Score

10^/10

glupteba privateloader redline risepro smokeloader zgrat @ytlogsbot horda livetraffic up3 backdoor google dropper evasion infostealer loader persistence phishing rat stealer trojan
- Detect ZGRat V1
- Detected google phishing page
  phishing google
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1