glupteba | 1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

General

Target

1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3
Size

4.2MB
Sample

240507-2eybfsbe3w
MD5

ce0464aede2fb24a6ea6f5ad8b10997e
SHA1

76230034883956a4436e5b285f6da427680eb206
SHA256

1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3
SHA512

3ba143915339560771ad92091ba9d825f268f3ece18b7e6bf1f6fb18f544ebbd23d6cfb51acfda103b71c83f7c001eb9b0c02b76287b6034a2b64f798844c777
SSDEEP

98304:8dBFtQBAe6Mq3XPKS49jjLuCFfDOw5elpHBKlxxKC:8PQSrdt4jjLuCFrF5elpYlxx3

Score

10^/10

glupteba dropper evasion execution loader upx

Static task

static1

Behavioral task

behavioral1

Sample

1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3.exe

Resource

win7-20231129-en

glupteba dropper evasion loader upx

windows7-x64

8 signatures

300 seconds

Behavioral task

behavioral2

Sample

1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3.exe

Resource

win10-20240404-en

glupteba dropper evasion execution loader upx

windows10-1703-x64

8 signatures

300 seconds

Malware Config

Targets

- Target
  
  1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3
- Size
  
  4.2MB
- MD5
  
  ce0464aede2fb24a6ea6f5ad8b10997e
- SHA1
  
  76230034883956a4436e5b285f6da427680eb206
- SHA256
  
  1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3
- SHA512
  
  3ba143915339560771ad92091ba9d825f268f3ece18b7e6bf1f6fb18f544ebbd23d6cfb51acfda103b71c83f7c001eb9b0c02b76287b6034a2b64f798844c777
- SSDEEP
  
  98304:8dBFtQBAe6Mq3XPKS49jjLuCFfDOw5elpHBKlxxKC:8PQSrdt4jjLuCFrF5elpYlxx3
Score

10^/10

glupteba dropper evasion loader upx execution
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies boot configuration data using bcdedit
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderupx

behavioral2

gluptebadropperevasionexecutionloaderupx

© 2018-2025

Terms | Privacy