glupteba | 2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62 | Triage

Submit
Reports

Overview

overview

Static

static

1

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

General

Target

2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62
Size

4.1MB
Sample

240516-2r7ewscf29
MD5

1157922d694e53092c8c05331878f8a1
SHA1

f63cbc1b6e261bd011352c0f64ec6238ec37c397
SHA256

2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62
SHA512

35d95d7672a2f3f1796317d3b455bc6575e997ce67c049a4ccc0971a8066820df1f0e069b9a1e07e615cf87685fdd0518859d4769f132f02fe38dfe534118ed1
SSDEEP

98304:cFETef+mmkxaPY+QSMo7d4VmoteWoCPtlnvHUEaCydSs:cFGef+mhxag+rMGd4V3tmut57ts

Score

10^/10

glupteba dropper evasion execution loader ransomware upx

Static task

static1

Behavioral task

behavioral1

Sample

2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62.exe

Resource

win7-20240221-en

glupteba dropper evasion loader ransomware upx

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral2

Sample

2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62.exe

Resource

win10-20240404-en

glupteba dropper evasion execution loader upx

windows10-1703-x64

7 signatures

300 seconds

Malware Config

Targets

- Target
  
  2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62
- Size
  
  4.1MB
- MD5
  
  1157922d694e53092c8c05331878f8a1
- SHA1
  
  f63cbc1b6e261bd011352c0f64ec6238ec37c397
- SHA256
  
  2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62
- SHA512
  
  35d95d7672a2f3f1796317d3b455bc6575e997ce67c049a4ccc0971a8066820df1f0e069b9a1e07e615cf87685fdd0518859d4769f132f02fe38dfe534118ed1
- SSDEEP
  
  98304:cFETef+mmkxaPY+QSMo7d4VmoteWoCPtlnvHUEaCydSs:cFGef+mhxag+rMGd4V3tmut57ts
Score

10^/10

glupteba dropper evasion loader ransomware upx execution
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

gluptebadropperevasionloaderransomwareupx

behavioral2

gluptebadropperevasionexecutionloaderupx

© 2018-2025

Terms | Privacy