glupteba | 407c70f0c1a1e34503dae74dd973cf037d607e3c4deb8f063d33f2142f1baf71 | Triage

Sharing

General

Target

89c47e27bec5a374476ffaf92ab2b6d2_JaffaCakes118
Size

6.9MB
Sample

240601-jfk4eaeb61
MD5

89c47e27bec5a374476ffaf92ab2b6d2
SHA1

6486a7db83b1be2ed5ef7239262d22508d3e075a
SHA256

407c70f0c1a1e34503dae74dd973cf037d607e3c4deb8f063d33f2142f1baf71
SHA512

f0c65570b230236b2dda4e326122f54b8174fd2d17c6e5c9ddb1b0f80c9733f023ba86252400dc0bc9ee314fb4023bd1dac6fda6297e17fe18493d175f2634bc
SSDEEP

98304:kzHf7vmorbC/yNwFC6TJZcE94Kcj3sA/Ibt1YcyDXs:+Hzvpr6FHt4Kc+NIs

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Targets

- Target
  
  89c47e27bec5a374476ffaf92ab2b6d2_JaffaCakes118
- Size
  
  6.9MB
- MD5
  
  89c47e27bec5a374476ffaf92ab2b6d2
- SHA1
  
  6486a7db83b1be2ed5ef7239262d22508d3e075a
- SHA256
  
  407c70f0c1a1e34503dae74dd973cf037d607e3c4deb8f063d33f2142f1baf71
- SHA512
  
  f0c65570b230236b2dda4e326122f54b8174fd2d17c6e5c9ddb1b0f80c9733f023ba86252400dc0bc9ee314fb4023bd1dac6fda6297e17fe18493d175f2634bc
- SSDEEP
  
  98304:kzHf7vmorbC/yNwFC6TJZcE94Kcj3sA/Ibt1YcyDXs:+Hzvpr6FHt4Kc+NIs
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan

behavioral2

gluptebadropperevasionloaderpersistence