Overview

overview

10

Static

static

1

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7aadea0ffd201893fd0c6984008d2e005018aca687175f549ffa18d89f0473c8

  • Size

    4.2MB

  • Sample

    240423-k79rhsfa5z

  • MD5

    a84dce9a95eeedaf7ccc348b0e88ffc6

  • SHA1

    fe9d11d7233e39069c96827e3c7ba063dad8daee

  • SHA256

    7aadea0ffd201893fd0c6984008d2e005018aca687175f549ffa18d89f0473c8

  • SHA512

    fb83e13702e4d61450e615be18cdb1dce02520b595bcaf12fbbae057203ac48646b21dea59dd201f56b1c8adac0f3689e257d05834555a0746f039c4851aef73

  • SSDEEP

    98304:CQN9zSKVNFzRCmd+S43cfxiJtNQ15bXu+MABfSPDEeLX1+Kw3YL/t3U:tTWsFQmkSqeYdK5bXuOBmD/txFE

Score
10/10
gluptebadropperevasionloaderpersistenceupx

Malware Config

Targets

    • Target

      7aadea0ffd201893fd0c6984008d2e005018aca687175f549ffa18d89f0473c8

    • Size

      4.2MB

    • MD5

      a84dce9a95eeedaf7ccc348b0e88ffc6

    • SHA1

      fe9d11d7233e39069c96827e3c7ba063dad8daee

    • SHA256

      7aadea0ffd201893fd0c6984008d2e005018aca687175f549ffa18d89f0473c8

    • SHA512

      fb83e13702e4d61450e615be18cdb1dce02520b595bcaf12fbbae057203ac48646b21dea59dd201f56b1c8adac0f3689e257d05834555a0746f039c4851aef73

    • SSDEEP

      98304:CQN9zSKVNFzRCmd+S43cfxiJtNQ15bXu+MABfSPDEeLX1+Kw3YL/t3U:tTWsFQmkSqeYdK5bXuOBmD/txFE

    Score
    10/10
    gluptebadropperevasionloaderpersistenceupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks