glupteba | f1fc54bb55c777066c56a11c04a4ce869e2aca192af571b2908aad2cf29cd4e6 | Triage

Submit
Reports

Overview

overview

Static

static

1

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

Copy URL Twitter E-mail

General

Target

f1fc54bb55c777066c56a11c04a4ce869e2aca192af571b2908aad2cf29cd4e6
Size

4.1MB
Sample

231224-2t11wshhf8
MD5

18c733d5d4d7cd4235f6293685a5c817
SHA1

e6454e98b5fc0ae9c4345e398f6d02fe68ff7279
SHA256

f1fc54bb55c777066c56a11c04a4ce869e2aca192af571b2908aad2cf29cd4e6
SHA512

2172fdc2d0e81c8f6285955a46f8930e7d31d08628f2246631838b04a15a60d5c6312c14c9751fceafdc1345bf0f6d4abc660e7feed910275a5888393f1eb775
SSDEEP

98304:Qa52ff2jzyldrDCZJjB9sVOM/6N8Rvyivcw8vqN0MrvjT18Bh:R52n2LpB+Mk6N8RKivOq6M5c

Score

10^/10

glupteba dropper evasion loader ransomware upx

Static task

static1

Behavioral task

behavioral1

Sample

f1fc54bb55c777066c56a11c04a4ce869e2aca192af571b2908aad2cf29cd4e6.exe

Resource

win7-20231215-en

glupteba dropper evasion loader ransomware upx

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral2

Sample

f1fc54bb55c777066c56a11c04a4ce869e2aca192af571b2908aad2cf29cd4e6.exe

Resource

win10-20231220-en

glupteba dropper evasion loader upx

windows10-1703-x64

6 signatures

300 seconds

Malware Config

Targets

- Target
  
  f1fc54bb55c777066c56a11c04a4ce869e2aca192af571b2908aad2cf29cd4e6
- Size
  
  4.1MB
- MD5
  
  18c733d5d4d7cd4235f6293685a5c817
- SHA1
  
  e6454e98b5fc0ae9c4345e398f6d02fe68ff7279
- SHA256
  
  f1fc54bb55c777066c56a11c04a4ce869e2aca192af571b2908aad2cf29cd4e6
- SHA512
  
  2172fdc2d0e81c8f6285955a46f8930e7d31d08628f2246631838b04a15a60d5c6312c14c9751fceafdc1345bf0f6d4abc660e7feed910275a5888393f1eb775
- SSDEEP
  
  98304:Qa52ff2jzyldrDCZJjB9sVOM/6N8Rvyivcw8vqN0MrvjT18Bh:R52n2LpB+Mk6N8RKivOq6M5c
Score

10^/10

glupteba dropper evasion loader ransomware upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

gluptebadropperevasionloaderransomwareupx

behavioral2

gluptebadropperevasionloaderupx

© 2018-2025

Terms | Privacy