glupteba

General

Target

18d1a10285383dbf8a2343e4b9c1fc3c.bin
Size

2.0MB
Sample

231228-bgrzcaadd2
MD5

a508f7da38b0332ec3d1d54ee398ef7e
SHA1

a66e57ce13c8ae87ae0b9db2c612d2325533d926
SHA256

8acc355f817bd975a4d642082de46b9b555cd78cf41f1bcb9049157fb9ad33fa
SHA512

ed82a56ab5daa957267f4a9fd254092ec1805f3121889f88854d7c397ef4cc980045ef7e3be4596316a4030568bfd6deb0b07c0a097898d826426da37ebd44c6
SSDEEP

49152:fl7Y3lsiI1uZj4bItumv3W3XeNAxN/aTTYaEFi3QQEQo5:fls3lg1+4bItum/QXeWkTTFE8gQEz5

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

stealc

C2

http://5.42.66.58

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

777

C2

195.20.16.103:20440

Targets

- Target
  
  952317229d1e77340b65639145073369a7e1a0a38718e05819c9c4791ecd5534.exe
- Size
  
  2.0MB
- MD5
  
  18d1a10285383dbf8a2343e4b9c1fc3c
- SHA1
  
  e0a53fa4e9f303e87dfe612a9495290ea27e21d3
- SHA256
  
  952317229d1e77340b65639145073369a7e1a0a38718e05819c9c4791ecd5534
- SHA512
  
  d3000f6115555a836661617e36c5af4bc61acfdff5b51b94136b8497de3a2b8d4b449dc1307726f434774500e960ae6f0f0c5bda94a041ca384f17cfbd32da46
- SSDEEP
  
  49152:MvVl3ySej9XajZGssKdpH/AoBbuejcxh7ZOGx74fp:a3CSekIT+AUNjMFZOGx70
Score

10^/10

collection discovery persistence spyware stealer glupteba lumma redline smokeloader stealc zgrat 777 up3 backdoor dropper evasion infostealer loader rat trojan
- Detect Lumma Stealer payload V4
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2