MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e43a04b037b6e092c352fcf85eef535cf036ee8a4b7100cb15f7343ab2b097f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Glupteba

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	3e43a04b037b6e092c352fcf85eef535cf036ee8a4b7100cb15f7343ab2b097f
SHA3-384 hash:	af30ad88d0d1abc2b56a7e9adef8b5816c822a1d3960dea97e87c369477c4d142e80d2e60964a34184424a18de64ae14
SHA1 hash:	3db99991178812a5d4f5f7468151055884109699
MD5 hash:	df73c80c3b297b161dd6681a354b9392
humanhash:	michigan-gee-finch-cola
File name:	df73c80c3b297b161dd6681a354b9392.exe
Download:	download sample
Signature	Glupteba Create hunting rule
File size:	1'997'312 bytes
First seen:	2021-02-16 18:56:44 UTC
Last seen:	2021-02-16 21:08:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	49152:1f4ZhLE/NUit9F2r2aZ+UhH3EvncqWyq:1mhI/X9caETB3EE2q
Threatray	80 similar samples on MalwareBazaar
TLSH	2F95331A23479571CC56BB76E106012AAF60B4360DA1F3583BD233E6FAD47D3232D9AD
Reporter	abuse_ch
Tags:	exe Glupteba

Intelligence

File Origin

# of uploads :

# of downloads :

670

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/117407/

Detection(s):

SecuriteInfo.com.Adware.ADWARE.CsdiMonetize.mlwbn.9817.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connecting to a non-recommended domain

Sending a custom TCP request

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a file

Creating a file in the %AppData% subdirectories

Sending a UDP request

Unauthorized injection to a recently created process

Result

Threat name:

Glupteba

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/609365

Signature

.NET source code contains potential unpacker

Antivirus detection for dropped file

Antivirus detection for URL or domain

Binary contains a suspicious time stamp

Creates multiple autostart registry keys

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Glupteba

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3e43a04b037b6e092c352fcf85eef535cf036ee8a4b7100cb15f7343ab2b097f/

Threat name:

ByteCode-MSIL.Adware.CSDIMonetize

Status:

Malicious

First seen:

2021-02-16 11:37:03 UTC

AV detection:

13 of 29 (44.83%)

Threat level:

1/5

Verdict:

malicious

Result

Malware family:

vidar

Score:

10/10

Tags:

family:djvu family:glupteba family:metasploit family:raccoon family:redline family:smokeloader family:vidar botnet:9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab botnet:ca73854068eef038c890b088b37802c3f505993c backdoor discovery dropper evasion infostealer loader persistence ransomware spyware stealer trojan upx

Link:

https://tria.ge/reports/210216-stahgjn492/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Enumerates system info in registry

Kills process with taskkill

Modifies Control Panel

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

NTFS ADS

Runs ping.exe

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks for any installed AV software in registry

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Maps connected drives based on registry

Checks computer location settings

Loads dropped DLL

Modifies file permissions

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Windows security modification

Drops file in Drivers directory

Executes dropped EXE

Modifies Windows Firewall

Possible attempt to disable PatchGuard

UPX packed file

ACProtect 1.3x - 1.4x DLL software

Checks for common network interception software

Modifies boot configuration data using bcdedit

Deletes Windows Defender Definitions

Djvu Ransomware

Glupteba

Glupteba Payload

MetaSploit

Raccoon

RedLine

RedLine Payload

SmokeLoader

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Windows security bypass

Malware Config

C2 Extraction:

http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
http://4zavr.com/upload/
http://zynds.com/upload/
http://atvua.com/upload/
http://detse.net/upload/
http://dsdett.com/upload/
http://dtabasee.com/upload/
http://yeronogles.monster/upload/
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/