glupteba

General

Target
Isetup2.exe
Size 764KB
Sample240519-bkwfyaaf55
SHA256 4ea1ba89caf3d2c01cb65b9b56c0ec569a975df788572aa6a95537b546f3a2fc
MD5 9ca07a18755fef4e505b233f3dddb6ea
SHA1 707705d5d4898eaef1238429447783db28554ba9
SHA512 4d8e43c3398064ffd37868617d76814cb27ba541724f4a5943d05e4ffe03afcfbf7dc293b62107803cd7b9ff5c059b9241c27fee15d7e2ae9716164c6d836693
SSDEEP 12288:UBfdmQiTgXF/OHYMhHQ7hLJQ9w5DUAinUKjZjk3G1MxnIDN5hZ2+y5JHF:UBFmntH9i7RJQ9wiBMxIHhKHF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Isetup2.exe
- Size 764KB
- SHA256 4ea1ba89caf3d2c01cb65b9b56c0ec569a975df788572aa6a95537b546f3a2fc
- MD5 9ca07a18755fef4e505b233f3dddb6ea
- SHA1 707705d5d4898eaef1238429447783db28554ba9
- SHA512 4d8e43c3398064ffd37868617d76814cb27ba541724f4a5943d05e4ffe03afcfbf7dc293b62107803cd7b9ff5c059b9241c27fee15d7e2ae9716164c6d836693
- SSDEEP 12288:UBfdmQiTgXF/OHYMhHQ7hLJQ9w5DUAinUKjZjk3G1MxnIDN5hZ2+y5JHF:UBFmntH9i7RJQ9wiBMxIHhKHF
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution glupteba xmrig bootkit dropper evasion loader miner persistence ransomware trojan upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies boot configuration data using bcdedit
  ransomware evasion
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2