glupteba | c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03 | Triage

Submit
Reports

Overview

overview

Static

static

1

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03
Size

4.1MB
Sample

240518-1vezdaad32
MD5

5d554990f88d73556fb9c539884a5ebe
SHA1

627b5540b78befb90725af0a8ec5ce3c57e08c72
SHA256

c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03
SHA512

f3282bdc6aff8380863d48dfa1ffec51e6405d91c1698a9964c04ef858dd9cf826a98d89e4bbe80c94e5a928aed93772599507e93913e816db6fcf73fe499291
SSDEEP

98304:BsVQ+hudF4keJeyEqK0evsENr9r54Wa5Cc1nHXivv:Bs5hioeyE6OsERj43n4

Score

10^/10

glupteba dropper evasion execution loader persistence upx

Static task

static1

Behavioral task

behavioral1

Sample

c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe

Resource

win10v2004-20240426-en

glupteba dropper evasion execution loader upx

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe

Resource

win11-20240426-en

glupteba dropper evasion execution loader persistence upx

windows11-21h2-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03
- Size
  
  4.1MB
- MD5
  
  5d554990f88d73556fb9c539884a5ebe
- SHA1
  
  627b5540b78befb90725af0a8ec5ce3c57e08c72
- SHA256
  
  c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03
- SHA512
  
  f3282bdc6aff8380863d48dfa1ffec51e6405d91c1698a9964c04ef858dd9cf826a98d89e4bbe80c94e5a928aed93772599507e93913e816db6fcf73fe499291
- SSDEEP
  
  98304:BsVQ+hudF4keJeyEqK0evsENr9r54Wa5Cc1nHXivv:Bs5hioeyE6OsERj43n4
Score

10^/10

glupteba dropper evasion execution loader upx persistence
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionexecutionloaderupx

behavioral2

gluptebadropperevasionexecutionloaderpersistenceupx

© 2018-2025

Terms | Privacy