Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

231db005bf...27.exe

windows7-x64

10

231db005bf...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    231db005bf29ea596c7af4c264c0cca57271bb67d2208dfb8e320a4462767327.exe

  • Size

    4.1MB

  • Sample

    240213-cs2hlaaa8w

  • MD5

    b157e72b328d941ff95bcedb357e2b1b

  • SHA1

    9697221387a51260eeb70fba1d17c271e443e716

  • SHA256

    231db005bf29ea596c7af4c264c0cca57271bb67d2208dfb8e320a4462767327

  • SHA512

    3a3946398d8aaa499a12a5809648e509a708860a4ca2991e277123351034061e4fa2839743c91822143e105cf48f315e46347608dc1ebac060d2a9ba039bd21d

  • SSDEEP

    49152:irtHaZL5Wjk2KurtcZtm0QlCmj+rYGWWB1XMO8YNtIyBSH302qqrJccUXAFAwijV:i5gLD3ycXi38WWB5tjCkyW4IRgc

Score
10/10
gluptebadropperevasionloaderupx

Malware Config

Targets

    • Target

      231db005bf29ea596c7af4c264c0cca57271bb67d2208dfb8e320a4462767327.exe

    • Size

      4.1MB

    • MD5

      b157e72b328d941ff95bcedb357e2b1b

    • SHA1

      9697221387a51260eeb70fba1d17c271e443e716

    • SHA256

      231db005bf29ea596c7af4c264c0cca57271bb67d2208dfb8e320a4462767327

    • SHA512

      3a3946398d8aaa499a12a5809648e509a708860a4ca2991e277123351034061e4fa2839743c91822143e105cf48f315e46347608dc1ebac060d2a9ba039bd21d

    • SSDEEP

      49152:irtHaZL5Wjk2KurtcZtm0QlCmj+rYGWWB1XMO8YNtIyBSH302qqrJccUXAFAwijV:i5gLD3ycXi38WWB5tjCkyW4IRgc

    Score
    10/10
    gluptebadropperevasionloaderupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables Discord URL observed in first stage droppers

    • Detects executables containing URLs to raw contents of a Github gist

    • Detects executables containing artifacts associated with disabling Widnows Defender

    • Detects executables referencing many varying, potentially fake Windows User-Agents

    • Modifies boot configuration data using bcdedit

    • UPX dump on OEP (original entry point)

    • Modifies Windows Firewall

      evasion

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks