Overview

overview

10

Static

static

1

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58ab56689aa0ca6484c63ecaec185f9e6f4be9d5cce3a06decc5155188342004

  • Size

    4.2MB

  • Sample

    240427-2crqwshh69

  • MD5

    83e6df52b92e9cce71c064c0b56e5a1d

  • SHA1

    052d350583149e7155034d03098b9820be4a5b58

  • SHA256

    58ab56689aa0ca6484c63ecaec185f9e6f4be9d5cce3a06decc5155188342004

  • SHA512

    0d8a1e19cad260cf616eea89bb25c80d3595ab4bbcb1df7b2e0567339e853a09022efeb4ff0b1a76b4f8e60489490676c56ee0474b7e54ee455a76e4e3d2bcad

  • SSDEEP

    98304:PamOmyh13YwSD+iffg9rOMOczucEEdNxQlfwo87Elwi0PG1E:PTy8Jy4o9ecZxQhwo8IinPG1E

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      58ab56689aa0ca6484c63ecaec185f9e6f4be9d5cce3a06decc5155188342004

    • Size

      4.2MB

    • MD5

      83e6df52b92e9cce71c064c0b56e5a1d

    • SHA1

      052d350583149e7155034d03098b9820be4a5b58

    • SHA256

      58ab56689aa0ca6484c63ecaec185f9e6f4be9d5cce3a06decc5155188342004

    • SHA512

      0d8a1e19cad260cf616eea89bb25c80d3595ab4bbcb1df7b2e0567339e853a09022efeb4ff0b1a76b4f8e60489490676c56ee0474b7e54ee455a76e4e3d2bcad

    • SSDEEP

      98304:PamOmyh13YwSD+iffg9rOMOczucEEdNxQlfwo87Elwi0PG1E:PTy8Jy4o9ecZxQhwo8IinPG1E

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks