glupteba | 54482bb6491ac66552a0756efee503ca56c165c957bea15703719058dc057b3d | Triage

Submit
Reports

Overview

overview

Static

static

3

5db4cf73b0...18.exe

windows7-x64

5db4cf73b0...18.exe

windows10-2004-x64

Sharing

General

Target

5db4cf73b0d9ae96ae84b11d328bd72d_JaffaCakes118
Size

3.8MB
Sample

240719-z54vtatgjb
MD5

5db4cf73b0d9ae96ae84b11d328bd72d
SHA1

fc519971bcf55a7b39ecff73aafaa048c81cbc4a
SHA256

54482bb6491ac66552a0756efee503ca56c165c957bea15703719058dc057b3d
SHA512

ee7df60a2747d0180ce60ca43e8d9394eb4922c10f328e5410229a8928e813ed6116b25ea473c659e95e58c1271b078d689caae5471cce7680d1e351acd1d51a
SSDEEP

98304:7HM/18G8jtzKtLiZ4QNh56thk7RrvBkDy7M0szFJ:7s/1TQzKK4QB6U7lvBkWwZ

Score

10^/10

glupteba dropper evasion loader persistence privilege_escalation trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5db4cf73b0d9ae96ae84b11d328bd72d_JaffaCakes118.exe

Resource

win7-20240705-en

glupteba dropper evasion loader persistence privilege_escalation trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

5db4cf73b0d9ae96ae84b11d328bd72d_JaffaCakes118.exe

Resource

win10v2004-20240709-en

glupteba dropper evasion loader persistence privilege_escalation

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  5db4cf73b0d9ae96ae84b11d328bd72d_JaffaCakes118
- Size
  
  3.8MB
- MD5
  
  5db4cf73b0d9ae96ae84b11d328bd72d
- SHA1
  
  fc519971bcf55a7b39ecff73aafaa048c81cbc4a
- SHA256
  
  54482bb6491ac66552a0756efee503ca56c165c957bea15703719058dc057b3d
- SHA512
  
  ee7df60a2747d0180ce60ca43e8d9394eb4922c10f328e5410229a8928e813ed6116b25ea473c659e95e58c1271b078d689caae5471cce7680d1e351acd1d51a
- SSDEEP
  
  98304:7HM/18G8jtzKtLiZ4QNh56thk7RrvBkDy7M0szFJ:7s/1TQzKK4QB6U7lvBkWwZ
Score

10^/10

glupteba dropper evasion loader persistence privilege_escalation trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadropperevasionloaderpersistenceprivilege_escalationtrojan

behavioral2

gluptebadropperevasionloaderpersistenceprivilege_escalation

© 2018-2025

Terms | Privacy