glupteba | 4fd5347f52e67b48fcd4071a78d3cf9ba6b939a104318f2abc19f806fe78a0ae | Triage

Submit
Reports

Overview

overview

Static

static

1

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

4fd5347f52e67b48fcd4071a78d3cf9ba6b939a104318f2abc19f806fe78a0ae
Size

4.2MB
Sample

240418-lpbmfaaf6v
MD5

cc768a71dab345faceff48c82bd07cec
SHA1

a1b3ca17bf81c9545c08eb499ca0c44868bcdb37
SHA256

4fd5347f52e67b48fcd4071a78d3cf9ba6b939a104318f2abc19f806fe78a0ae
SHA512

a4f2cf98ae9477861cd6456741dadb1a8f12d03705b1521bf63004834a8ccfb186f2bf3c7efe92f119ee734ed8f1cab0485d0376e2b3f8f4bcc46a95b0a7170f
SSDEEP

98304:0CPl518CIueKP5d7oVK7H7yJZnHQCD3+yubJ0gajSU:x518Ue6qZnwCDRsJZVU

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Static task

static1

Behavioral task

behavioral1

Sample

4fd5347f52e67b48fcd4071a78d3cf9ba6b939a104318f2abc19f806fe78a0ae.exe

Resource

win10v2004-20240412-en

glupteba discovery dropper evasion loader persistence upx

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

4fd5347f52e67b48fcd4071a78d3cf9ba6b939a104318f2abc19f806fe78a0ae.exe

Resource

win11-20240412-en

glupteba discovery dropper evasion loader persistence rootkit upx

windows11-21h2-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  4fd5347f52e67b48fcd4071a78d3cf9ba6b939a104318f2abc19f806fe78a0ae
- Size
  
  4.2MB
- MD5
  
  cc768a71dab345faceff48c82bd07cec
- SHA1
  
  a1b3ca17bf81c9545c08eb499ca0c44868bcdb37
- SHA256
  
  4fd5347f52e67b48fcd4071a78d3cf9ba6b939a104318f2abc19f806fe78a0ae
- SHA512
  
  a4f2cf98ae9477861cd6456741dadb1a8f12d03705b1521bf63004834a8ccfb186f2bf3c7efe92f119ee734ed8f1cab0485d0376e2b3f8f4bcc46a95b0a7170f
- SSDEEP
  
  98304:0CPl518CIueKP5d7oVK7H7yJZnHQCD3+yubJ0gajSU:x518Ue6qZnwCDRsJZVU
Score

10^/10

glupteba discovery dropper evasion loader persistence upx rootkit
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistenceupx

behavioral2

gluptebadiscoverydropperevasionloaderpersistencerootkitupx

© 2018-2024

Terms | Privacy