glupteba | 61a393a246e072708bf50f693bfa39609d3486d333c2ffc872f01b16130b8438 | Triage

Submit
Reports

Overview

overview

Static

static

a85c6a3dc9...18.exe

windows7-x64

a85c6a3dc9...18.exe

windows10-2004-x64

Sharing

General

Target

a85c6a3dc9497ce229b56769fabe8310_JaffaCakes118
Size

7.1MB
Sample

240614-hdlrgsydqg
MD5

a85c6a3dc9497ce229b56769fabe8310
SHA1

1ef89b3b88c8533520938262229d892ae634e3b0
SHA256

61a393a246e072708bf50f693bfa39609d3486d333c2ffc872f01b16130b8438
SHA512

9da9b0eb42becce392c730b0eca9cd003ec050811994d87f88ae6bdcffc442a736ded9fbd7f280afb6bdb788ba1d6941163390be98a2aa46b2d1533ae4f6376c
SSDEEP

98304:5Q8/Py9frbxvXKKkGxTVhG2+9Mpq6vQt/Ibt1YcyDgssg:68nylrZtjG9MpqINnsD

Score

10^/10

glupteba ramnit banker dropper evasion loader persistence spyware stealer trojan upx worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

a85c6a3dc9497ce229b56769fabe8310_JaffaCakes118.exe

Resource

win7-20240508-en

glupteba ramnit banker dropper evasion loader persistence spyware stealer trojan upx worm

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

a85c6a3dc9497ce229b56769fabe8310_JaffaCakes118.exe

Resource

win10v2004-20240508-en

glupteba ramnit banker dropper evasion loader persistence spyware stealer trojan upx worm

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  a85c6a3dc9497ce229b56769fabe8310_JaffaCakes118
- Size
  
  7.1MB
- MD5
  
  a85c6a3dc9497ce229b56769fabe8310
- SHA1
  
  1ef89b3b88c8533520938262229d892ae634e3b0
- SHA256
  
  61a393a246e072708bf50f693bfa39609d3486d333c2ffc872f01b16130b8438
- SHA512
  
  9da9b0eb42becce392c730b0eca9cd003ec050811994d87f88ae6bdcffc442a736ded9fbd7f280afb6bdb788ba1d6941163390be98a2aa46b2d1533ae4f6376c
- SSDEEP
  
  98304:5Q8/Py9frbxvXKKkGxTVhG2+9Mpq6vQt/Ibt1YcyDgssg:68nylrZtjG9MpqINnsD
Score

10^/10

glupteba ramnit banker dropper evasion loader persistence spyware stealer trojan upx worm
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebaramnitbankerdropperevasionloaderpersistencespywarestealertrojanupxworm

behavioral2

gluptebaramnitbankerdropperevasionloaderpersistencespywarestealertrojanupxworm

© 2018-2025

Terms | Privacy