glupteba

General

Target

c99bfa2bf903c9f9681fac9d6a3122d4.exe
Size

37KB
Sample

231230-st6rpsced2
MD5

c99bfa2bf903c9f9681fac9d6a3122d4
SHA1

289fe6bebb1bc5b2555b8b61161b948d8d18310d
SHA256

e1f48f331e2554def3e7d7e386503219ff8d15d5b99d1682570235fcf15da315
SHA512

04345647f67ec502ff6e6023d2190ff05cbb416da98584488da3e0a9a34de9487ec7342f0b8d28b5b57c560334502f240c441fc68e4f8ddd4f4b3eb73ea5d1dd
SSDEEP

768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.79.30.95:13856

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

777

C2

195.20.16.103:20440

Targets

- Target
  
  c99bfa2bf903c9f9681fac9d6a3122d4.exe
- Size
  
  37KB
- MD5
  
  c99bfa2bf903c9f9681fac9d6a3122d4
- SHA1
  
  289fe6bebb1bc5b2555b8b61161b948d8d18310d
- SHA256
  
  e1f48f331e2554def3e7d7e386503219ff8d15d5b99d1682570235fcf15da315
- SHA512
  
  04345647f67ec502ff6e6023d2190ff05cbb416da98584488da3e0a9a34de9487ec7342f0b8d28b5b57c560334502f240c441fc68e4f8ddd4f4b3eb73ea5d1dd
- SSDEEP
  
  768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3
Score

10^/10

glupteba smokeloader up3 backdoor dropper evasion loader trojan redline stealc zgrat 777 livetraffic infostealer rat stealer upx
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2