glupteba | 1467fe3265b0b8f88e0987481406fd4f12d52deed6121f5af99c2d2b9b20d99c | Triage

Sharing

General

Target

a410f6bd37a266dc450fa073629b7cbc_JaffaCakes118
Size

5.2MB
Sample

240613-gjqf7azgkk
MD5

a410f6bd37a266dc450fa073629b7cbc
SHA1

48fafe2c47daec3bc90b4fc92ca1eaef5f2da171
SHA256

1467fe3265b0b8f88e0987481406fd4f12d52deed6121f5af99c2d2b9b20d99c
SHA512

df8eb046c879e1adf95b24fdd100ca69440b2287f0cb90f70894232f726a64f24012e9bc13031087ffb2efbc987e93a9621c1b458043ef0c676b6e1c6377fc89
SSDEEP

49152:1eaOFKQPrvUrRiGcdoVsyG/3JojFPpeiYDp2kNNJ7H8lsL6oUlMXhRMHwERw7s7b:aFLIgoVsyGBojpClTHXhRy/RwI4MJ9

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Targets

- Target
  
  a410f6bd37a266dc450fa073629b7cbc_JaffaCakes118
- Size
  
  5.2MB
- MD5
  
  a410f6bd37a266dc450fa073629b7cbc
- SHA1
  
  48fafe2c47daec3bc90b4fc92ca1eaef5f2da171
- SHA256
  
  1467fe3265b0b8f88e0987481406fd4f12d52deed6121f5af99c2d2b9b20d99c
- SHA512
  
  df8eb046c879e1adf95b24fdd100ca69440b2287f0cb90f70894232f726a64f24012e9bc13031087ffb2efbc987e93a9621c1b458043ef0c676b6e1c6377fc89
- SSDEEP
  
  49152:1eaOFKQPrvUrRiGcdoVsyG/3JojFPpeiYDp2kNNJ7H8lsL6oUlMXhRMHwERw7s7b:aFLIgoVsyGBojpClTHXhRy/RwI4MJ9
Score

10^/10

glupteba dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistencetrojan

behavioral2

gluptebadropperevasionloaderpersistence