glupteba | 98ad0e0d00d2f78539c6259f6870c1825c92e79b1aabb6dfa62a2281694fbd5b | Triage

Submit
Reports

Overview

overview

Static

static

1

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

Copy URL Twitter E-mail

General

Target

98ad0e0d00d2f78539c6259f6870c1825c92e79b1aabb6dfa62a2281694fbd5b
Size

4.1MB
Sample

240101-fmxh8sefh2
MD5

609b8d7ef82f2ab60e8c86fb9327229f
SHA1

448fe81b7c6cf2bbe19f040ae96677180748e017
SHA256

98ad0e0d00d2f78539c6259f6870c1825c92e79b1aabb6dfa62a2281694fbd5b
SHA512

c078a1ef616551b10b2ed90cee89f2ba8892f52bb08be938244adf9088bdbaf7ebb7c93a955c8ee11b6a2f335e940bff471252430c7d93aaf3bf055972ad7108
SSDEEP

98304:9QlvhVUK9y1jw9BsMDJYBKDeCuAK2fz2V+YHUPoxmvKG5:RK9yC9GhBKY32fz2pUP7KC

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

98ad0e0d00d2f78539c6259f6870c1825c92e79b1aabb6dfa62a2281694fbd5b.exe

Resource

win7-20231215-en

glupteba discovery dropper evasion loader persistence rootkit trojan upx

windows7-x64

22 signatures

300 seconds

Behavioral task

behavioral2

Sample

98ad0e0d00d2f78539c6259f6870c1825c92e79b1aabb6dfa62a2281694fbd5b.exe

Resource

win10-20231215-en

glupteba discovery dropper evasion loader persistence rootkit trojan upx

windows10-1703-x64

20 signatures

300 seconds

Malware Config

Targets

- Target
  
  98ad0e0d00d2f78539c6259f6870c1825c92e79b1aabb6dfa62a2281694fbd5b
- Size
  
  4.1MB
- MD5
  
  609b8d7ef82f2ab60e8c86fb9327229f
- SHA1
  
  448fe81b7c6cf2bbe19f040ae96677180748e017
- SHA256
  
  98ad0e0d00d2f78539c6259f6870c1825c92e79b1aabb6dfa62a2281694fbd5b
- SHA512
  
  c078a1ef616551b10b2ed90cee89f2ba8892f52bb08be938244adf9088bdbaf7ebb7c93a955c8ee11b6a2f335e940bff471252430c7d93aaf3bf055972ad7108
- SSDEEP
  
  98304:9QlvhVUK9y1jw9BsMDJYBKDeCuAK2fz2V+YHUPoxmvKG5:RK9yC9GhBKY32fz2pUP7KC
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Modifies boot configuration data using bcdedit
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

behavioral2

gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

© 2018-2025

Terms | Privacy