glupteba | ba6ebb75ddaf850392f61dd6d4e878a7283a43f996ec2677777e3b2fbf9e1e9d | Triage

Sharing

General

Target

e6c9ec0cf5a24665dc259352ca67face_JaffaCakes118
Size

2.9MB
Sample

240917-pbc5wssard
MD5

e6c9ec0cf5a24665dc259352ca67face
SHA1

c6a1fc7f0c46782999fd356c60d6e66889918c57
SHA256

ba6ebb75ddaf850392f61dd6d4e878a7283a43f996ec2677777e3b2fbf9e1e9d
SHA512

a9af0a5af15db59542160ac74a57213bae309445d7ea2f04cafc61b1d4d68f83de1f6be664aaa65c6d3bebdaa0699389f281f1c2670eb17e88ef71645853693f
SSDEEP

49152:X65xtuYXTLtFyhVkCkctkTotsE2jgnL4f/DBrGFbKocfTbn7PSUC6m1voZf41pP8:Xs2qUtsE2jdXDB0bKocfOBNARsZYl

Score

10^/10

glupteba discovery dropper evasion loader persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  e6c9ec0cf5a24665dc259352ca67face_JaffaCakes118
- Size
  
  2.9MB
- MD5
  
  e6c9ec0cf5a24665dc259352ca67face
- SHA1
  
  c6a1fc7f0c46782999fd356c60d6e66889918c57
- SHA256
  
  ba6ebb75ddaf850392f61dd6d4e878a7283a43f996ec2677777e3b2fbf9e1e9d
- SHA512
  
  a9af0a5af15db59542160ac74a57213bae309445d7ea2f04cafc61b1d4d68f83de1f6be664aaa65c6d3bebdaa0699389f281f1c2670eb17e88ef71645853693f
- SSDEEP
  
  49152:X65xtuYXTLtFyhVkCkctkTotsE2jgnL4f/DBrGFbKocfTbn7PSUC6m1voZf41pP8:Xs2qUtsE2jdXDB0bKocfOBNARsZYl
Score

10^/10

glupteba discovery dropper evasion loader persistence privilege_escalation trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistenceprivilege_escalationtrojan

behavioral2

gluptebadiscoverydropperevasionloaderpersistenceprivilege_escalation