MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39264a6f15e8a51bab03924312a3dd05fc58a8d2b4aac39ca00e4cf16c9a21a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Glupteba


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39264a6f15e8a51bab03924312a3dd05fc58a8d2b4aac39ca00e4cf16c9a21a9
SHA3-384 hash: 63a5d8c94b5ea684dd976702740cbe571f2bf2f15ae1fe34eb4ac1e5b88d2ecbe11126bf6cea29596a45d4131bfef5e2
SHA1 hash: c65a703f8bc085832c12ebbe52ac56eb25bec493
MD5 hash: 8b5bc3aeb29f2efa106ff81421feed5a
humanhash: lima-bacon-november-july
File name:39264a6f15e8a51bab03924312a3dd05fc58a8d2b4aac39ca00e4cf16c9a21a9
Download: download sample
Signature Glupteba
Create hunting rule
File size:3'968'512 bytes
First seen:2020-06-03 09:13:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f240a57043e4d2613ebb75eb522dc9ae (1 x Glupteba)
ssdeep 98304:ZE+Ho7mDoFPgPZ7y6Dmfx8Wykpm0lMnWyqAII4Kpu:ZzHo7ME6HWNzMhpII4p
Threatray 91 similar samples on MalwareBazaar
TLSH 330633563180EC37DC1621B9A9898FC373264D12B3588C5F63797F2F6EBD2940476B8A
Reporter raashidbhatt
Tags:exe Glupteba

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'223
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Malware.PDB-11.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 08:28:11 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=heteu3yv5csrxkydsjbrfi65ax6frkgswsvmhhfabzgpc3e2eguq._file
Verdict:
malicious
Similar samples:
34c2eed8a266d3b5221bb51f0b5a59712b01d0b339a1db8f626688cb8fb81030
Glupteba
37c78d45542b2109dcf160591e570469946ffcdfb5042cede4671eef5543c5c9
Glupteba
5851f851fd3f4818e16bcf8ac00b723f43d2efd4b2d1acd3c506a8d32f8de14b
Glupteba
82686d76af9091e9988d8814900e65641e76d1cbedb261b9496a87708f7dd01f
Glupteba
86fce58f93e4087e261c52befbb872ddafeb8129008d5153c90084cd4a4a45d0
Glupteba
9f0c58f568c713eb2a7fc4836806a3e70bcdb41d05bfc75a1f815c64d856afde
Glupteba
b7db5b70b15ebac71e0aa8d7cb4e5f663171721b03157644cc2880a38337048a
Glupteba
c006abbb1bae333e5973f9c419bfd9c3c721698cf2cf3ffbd1048fdfb4de811b
Glupteba
cb1ffa5cd81d50702ee7296cd788a66fa8d5aa422e5cb4cdaca5a2ea4322141f
Glupteba
f4be8a038fc4b681a850d8ecaecc1f663d41bf27daf4f1af9c4cee1a3f63ae1a
Glupteba
+ 81 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion persistence trojan upx
Link:
https://tria.ge/reports/201109-bl19qfly8a/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
GoLang User-Agent
Suspicious behavior: LoadsDriver
Drops file in Windows directory
Launches sc.exe
Modifies service
Adds Run key to start application
Checks installed software on the system
JavaScript code in executable
Loads dropped DLL
Windows security modification
Executes dropped EXE
Modifies Windows Firewall
Drops file in Drivers directory
UPX packed file
Modifies boot configuration data using bcdedit
Windows security bypass
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments