glupteba

General

Target

bf0cbdb53bbd724bb231f0b6958edfc4.exe
Size

38KB
Sample

231228-qv8lkshfan
MD5

bf0cbdb53bbd724bb231f0b6958edfc4
SHA1

d825f3d47987356477f6a1d916a0e34cb581ecc5
SHA256

41d04caed8474ba34136c1e831cd345086a4fd4259557ec16f9c4cc99fb603cb
SHA512

5073f5f04c954de70247254e1983939c330fa95f11e1d36f615f52a9649e77f8ffa93269ba19b7a734f4528ad5907b3e960414a54ee442dd1e1a70365af1358e
SSDEEP

768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

stealc

C2

http://5.42.66.58

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

777

C2

195.20.16.103:20440

Targets

- Target
  
  bf0cbdb53bbd724bb231f0b6958edfc4.exe
- Size
  
  38KB
- MD5
  
  bf0cbdb53bbd724bb231f0b6958edfc4
- SHA1
  
  d825f3d47987356477f6a1d916a0e34cb581ecc5
- SHA256
  
  41d04caed8474ba34136c1e831cd345086a4fd4259557ec16f9c4cc99fb603cb
- SHA512
  
  5073f5f04c954de70247254e1983939c330fa95f11e1d36f615f52a9649e77f8ffa93269ba19b7a734f4528ad5907b3e960414a54ee442dd1e1a70365af1358e
- SSDEEP
  
  768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3
Score

10^/10

glupteba smokeloader stealc zgrat up3 backdoor discovery dropper evasion loader rat stealer trojan redline 777 infostealer persistence
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers COM server for autorun
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies boot configuration data using bcdedit
- Suspicious use of SetThreadContext
behavioral1 behavioral2