glupteba | 25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0 | Triage

Submit
Reports

Overview

overview

Static

static

1

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0
Size

4.2MB
Sample

240415-ychw7sed36
MD5

469ace49eafd4a129726477ab11ea293
SHA1

3b39f6be2721a02162a173fb7c9bd4708e9133c0
SHA256

25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0
SHA512

65b087a3f56f3621811818fb39bbaa072fadc1fc3a21636c2dbad79e28c9cd69113af30534ab3234912642f2feb60bf17d5caf0515fbef400a74aaeefada71dd
SSDEEP

98304:DsWc8naSrBchbGtEv0JHIgMwpxxX5hi9ihYSp8HY:YPUzBrIgMADi23

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Static task

static1

Behavioral task

behavioral1

Sample

25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0.exe

Resource

win10v2004-20240412-en

glupteba discovery dropper evasion loader persistence rootkit upx

windows10-2004-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0.exe

Resource

win11-20240412-en

glupteba discovery dropper evasion loader persistence rootkit

windows11-21h2-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0
- Size
  
  4.2MB
- MD5
  
  469ace49eafd4a129726477ab11ea293
- SHA1
  
  3b39f6be2721a02162a173fb7c9bd4708e9133c0
- SHA256
  
  25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0
- SHA512
  
  65b087a3f56f3621811818fb39bbaa072fadc1fc3a21636c2dbad79e28c9cd69113af30534ab3234912642f2feb60bf17d5caf0515fbef400a74aaeefada71dd
- SSDEEP
  
  98304:DsWc8naSrBchbGtEv0JHIgMwpxxX5hi9ihYSp8HY:YPUzBrIgMADi23
Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencerootkitupx

behavioral2

gluptebadiscoverydropperevasionloaderpersistencerootkit

© 2018-2025

Terms | Privacy