glupteba

General

Target

df65905b3f10c47b81ab22ebe370bab5db1a38d511338e6e8cc1ff7294a61744
Size

521KB
Sample

240507-h2kjbsec7s
MD5

c1d583657c7fe7973f820983fd1abb81
SHA1

4cfada887af87f32224fca86ed32edcac00edbec
SHA256

df65905b3f10c47b81ab22ebe370bab5db1a38d511338e6e8cc1ff7294a61744
SHA512

2dc55bbf18ca62a8e5834d7341a646d3ea082eca7e28ad9c75f72e5813ea46cf10ab9fa98d7ab2f2830633f438aa19f2eb4af768dee4b7a130f8eec17936dd88
SSDEEP

12288:jpDxMM2vWugFMfmKL9ZVvwtgEOy9bxKdyH6WS2Fft:19MMYzftL97sgoKOSU1

Score

10^/10

Malware Config

Targets

- Target
  
  df65905b3f10c47b81ab22ebe370bab5db1a38d511338e6e8cc1ff7294a61744
- Size
  
  521KB
- MD5
  
  c1d583657c7fe7973f820983fd1abb81
- SHA1
  
  4cfada887af87f32224fca86ed32edcac00edbec
- SHA256
  
  df65905b3f10c47b81ab22ebe370bab5db1a38d511338e6e8cc1ff7294a61744
- SHA512
  
  2dc55bbf18ca62a8e5834d7341a646d3ea082eca7e28ad9c75f72e5813ea46cf10ab9fa98d7ab2f2830633f438aa19f2eb4af768dee4b7a130f8eec17936dd88
- SSDEEP
  
  12288:jpDxMM2vWugFMfmKL9ZVvwtgEOy9bxKdyH6WS2Fft:19MMYzftL97sgoKOSU1
Score

10^/10

evasion execution trojan glupteba privateloader zgrat discovery dropper loader rat spyware stealer themida
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2