Overview

overview

10

Static

static

1

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df7a8bc783c2b9c463d518711fce26a794528551814d3d59b0832be671ffc7b5

  • Size

    4.1MB

  • Sample

    240427-vxpcyadg7w

  • MD5

    5b999c9b35c412a346882dbdf84d928f

  • SHA1

    0ae7ac625fc09e5f06f5a6fb193a0983c331eba7

  • SHA256

    df7a8bc783c2b9c463d518711fce26a794528551814d3d59b0832be671ffc7b5

  • SHA512

    740cb5febd791f030041c1b11ec2cd9148832cfa214af0502e4dc76f153f4a12f2e6fdf5db5e077525ddbc56ee0118313772aead41c9685127d8ec03e064b066

  • SSDEEP

    98304:9B+pokA3uLr67t8MVyOHX+J6fh0VTXiCNKfogoP0GUbubAel:9Bc4uLrIK0u8fYNDf0GUb+Ael

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      df7a8bc783c2b9c463d518711fce26a794528551814d3d59b0832be671ffc7b5

    • Size

      4.1MB

    • MD5

      5b999c9b35c412a346882dbdf84d928f

    • SHA1

      0ae7ac625fc09e5f06f5a6fb193a0983c331eba7

    • SHA256

      df7a8bc783c2b9c463d518711fce26a794528551814d3d59b0832be671ffc7b5

    • SHA512

      740cb5febd791f030041c1b11ec2cd9148832cfa214af0502e4dc76f153f4a12f2e6fdf5db5e077525ddbc56ee0118313772aead41c9685127d8ec03e064b066

    • SSDEEP

      98304:9B+pokA3uLr67t8MVyOHX+J6fh0VTXiCNKfogoP0GUbubAel:9Bc4uLrIK0u8fYNDf0GUb+Ael

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks