glupteba

General

Target

0x000600000002321e-639.dat
Size

38KB
Sample

231230-s98agaceg8
MD5

251a04dcae43d733a7beff1724f99fbe
SHA1

834cd1e1c218ac4a71003cb3151acb0cff0ef073
SHA256

a1e4f033baf6ddddff930d3e0da1020e20bc79cb053b5ab525252778a8c1f06a
SHA512

f8177efc94121708127518d7ee8d6fccda2a8b6c6859021646f60d8897ece75c8efaef864d42e31603e8d660b8124c7e33a4a23501b0997faa42eefe4e296786
SSDEEP

768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.79.30.95:13856

Extracted

Family

redline

Botnet

777

C2

195.20.16.103:20440

Targets

- Target
  
  0x000600000002321e-639.dat
- Size
  
  38KB
- MD5
  
  251a04dcae43d733a7beff1724f99fbe
- SHA1
  
  834cd1e1c218ac4a71003cb3151acb0cff0ef073
- SHA256
  
  a1e4f033baf6ddddff930d3e0da1020e20bc79cb053b5ab525252778a8c1f06a
- SHA512
  
  f8177efc94121708127518d7ee8d6fccda2a8b6c6859021646f60d8897ece75c8efaef864d42e31603e8d660b8124c7e33a4a23501b0997faa42eefe4e296786
- SSDEEP
  
  768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3
Score

10^/10

smokeloader up3 backdoor evasion trojan glupteba redline stealc 777 livetraffic dropper infostealer loader stealer
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2