Overview

overview

10

Static

static

1

693fa17c69...da.exe

windows7-x64

10

693fa17c69...da.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    693fa17c698273ec0029c95a052cebf63a9e00c8e9ccc9cc1c77b586425efcda.exe

  • Size

    4.1MB

  • Sample

    240607-b5ph5agf69

  • MD5

    881aa53278b6fd49243280d29897d19d

  • SHA1

    dd028f2c1f5b5356e81eadc0e39f263105847f19

  • SHA256

    693fa17c698273ec0029c95a052cebf63a9e00c8e9ccc9cc1c77b586425efcda

  • SHA512

    2fd0d0eef468aa3ebac35c2979976214ba4c7c49a2bd86ddbd48be30c87073bbc67f72e171ec7056d14e4671561d16a636f47664db861a1227ce75e07d12c49c

  • SSDEEP

    98304:JGrnwiB2dYFBQLVw0Jv37FWi1chPr/xRmmjECQgDNU:JG7LuY/yhvJWf/qmwCQmU

Score
10/10
gluptebadropperevasionexecutionloader

Malware Config

Targets

    • Target

      693fa17c698273ec0029c95a052cebf63a9e00c8e9ccc9cc1c77b586425efcda.exe

    • Size

      4.1MB

    • MD5

      881aa53278b6fd49243280d29897d19d

    • SHA1

      dd028f2c1f5b5356e81eadc0e39f263105847f19

    • SHA256

      693fa17c698273ec0029c95a052cebf63a9e00c8e9ccc9cc1c77b586425efcda

    • SHA512

      2fd0d0eef468aa3ebac35c2979976214ba4c7c49a2bd86ddbd48be30c87073bbc67f72e171ec7056d14e4671561d16a636f47664db861a1227ce75e07d12c49c

    • SSDEEP

      98304:JGrnwiB2dYFBQLVw0Jv37FWi1chPr/xRmmjECQgDNU:JG7LuY/yhvJWf/qmwCQmU

    Score
    10/10
    gluptebadropperevasionloaderexecution

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables Discord URL observed in first stage droppers

    • Detects executables containing URLs to raw contents of a Github gist

    • Detects executables containing artifacts associated with disabling Widnows Defender

    • Detects executables referencing many varying, potentially fake Windows User-Agents

    • Modifies Windows Firewall

      evasion

    • Modifies boot configuration data using bcdedit

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks