glupteba

General

Target

a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9
Size

315KB
Sample

240329-cat1ssee41
MD5

5fe67781ffe47ec36f91991abf707432
SHA1

137e6d50387a837bf929b0da70ab6b1512e95466
SHA256

a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9
SHA512

0e32d9a72b562d4c4a8c4edbd3d0ece54b67ee87c8ac382c6508c62b04b11a2dcd1fba23c3a78004fcd0c2b623dc854fd2fd82eb372dc7becdcbdd7ec7fe1b68
SSDEEP

3072:Q/uViE3w/D/5q+eF/2HjXuq4wQa+pOhKRIEcwE3G/uWQnDPPWCA6jeCKGAY:Q/uVi35q+bGVO7xSQPPfxahhY

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Extracted

Family

lumma

C2

https://democraticseekysiwo.shop/api

Targets

- Target
  
  a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9
- Size
  
  315KB
- MD5
  
  5fe67781ffe47ec36f91991abf707432
- SHA1
  
  137e6d50387a837bf929b0da70ab6b1512e95466
- SHA256
  
  a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9
- SHA512
  
  0e32d9a72b562d4c4a8c4edbd3d0ece54b67ee87c8ac382c6508c62b04b11a2dcd1fba23c3a78004fcd0c2b623dc854fd2fd82eb372dc7becdcbdd7ec7fe1b68
- SSDEEP
  
  3072:Q/uViE3w/D/5q+eF/2HjXuq4wQa+pOhKRIEcwE3G/uWQnDPPWCA6jeCKGAY:Q/uVi35q+bGVO7xSQPPfxahhY
Score

10^/10

glupteba smokeloader backdoor discovery dropper evasion loader persistence rootkit trojan upx lumma spyware stealer
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMon driver.
  Roottkits write to WinMon to hide PIDs from being detected.
  rootkit evasion
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2