glupteba

General

Target

ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77
Size

2.9MB
Sample

240501-hjm7haac5x
MD5

4cea9711ee6cf7c880c00246253fd14a
SHA1

9f6638447748bf03d2255baa3eff09befe67e5e8
SHA256

ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77
SHA512

9a154d4ea2cb0ca2b40cf6beac9457990800cf7c28171be088b159b5890336f341670bc3bb34b079f713bb9e16501230c4edf0b5ff5531f508ff0bc9b7658ada
SSDEEP

49152:8zBfc7Dt4yQMOEH/QzQSvO6cDEsVDKNxPIJKWNWrblFeeHfJ0JDe4EwgG6qJOr:8zuK2WvxsV2NShNQN/JSZEc2

Score

10^/10

Malware Config

Targets

- Target
  
  ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77
- Size
  
  2.9MB
- MD5
  
  4cea9711ee6cf7c880c00246253fd14a
- SHA1
  
  9f6638447748bf03d2255baa3eff09befe67e5e8
- SHA256
  
  ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77
- SHA512
  
  9a154d4ea2cb0ca2b40cf6beac9457990800cf7c28171be088b159b5890336f341670bc3bb34b079f713bb9e16501230c4edf0b5ff5531f508ff0bc9b7658ada
- SSDEEP
  
  49152:8zBfc7Dt4yQMOEH/QzQSvO6cDEsVDKNxPIJKWNWrblFeeHfJ0JDe4EwgG6qJOr:8zuK2WvxsV2NShNQN/JSZEc2
Score

10^/10

evasion trojan glupteba privateloader sectoprat zgrat discovery dropper loader rat spyware stealer themida
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2