MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 919a4877c1435674718c7ffd0c8c5ff7f5876be471fd8419875fb5dc1bdf3dd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Glupteba


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 919a4877c1435674718c7ffd0c8c5ff7f5876be471fd8419875fb5dc1bdf3dd9
SHA3-384 hash: c0c468d0460251e3a5e8a12b81bbbf3cfbc6a5370a9d9cbccb97a118010c9837e3d99a8b49141cc75fdd7d717d6a1aad
SHA1 hash: 24fe6bd49ca4c8ce497534a32f3ec9a998960e87
MD5 hash: 7a85a5a4542ab10ebf165aa13b329a27
humanhash: mountain-grey-vermont-monkey
File name:file.exe
Download: download sample
Signature Glupteba
Create hunting rule
File size:4'656'128 bytes
First seen:2021-05-23 17:43:55 UTC
Last seen:2021-05-23 18:00:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 48d2401545bc23ddf9125d8d09f6c7f1 (4 x RaccoonStealer, 1 x Glupteba, 1 x CryptBot)
ssdeep 98304:h1VWkzfEVIdBRj+Aq2gcyZ/D9jvTpNnk77c6ALzomKgTRlX:1MVIHMA5gVZ/hC3AJKWR
Threatray 94 similar samples on MalwareBazaar
TLSH 892633206463C034F0BF12F08876416966267FA09B2784FBE2C576EEA93A5F56D3174F
Reporter Anonymous
Tags:exe Glupteba


Avatar
Anonymous
unknown source

Intelligence

File Origin
# of uploads :
2
# of downloads :
343
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
No threats detected
Analysis date:
2021-05-23 17:46:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/04100979-b4a1-4263-a3d3-2e2c36398bea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/160942/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Using the Windows Management Instrumentation requests
Launching a service
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching the process to change the firewall settings
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding exclusions to Windows Defender
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/789705
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates an autostart registry key pointing to binary in C:\Windows
Creates files in the system32 config directory
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS TXT record lookups
Sample is not signed and drops a device driver
Sigma detected: Schedule system process
Sigma detected: Suspicious Service DACL Modification
Sigma detected: System File Execution Location Anomaly
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Uses shutdown.exe to shutdown or reboot the system
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 422101 Sample: file.exe Startdate: 23/05/2021 Architecture: WINDOWS Score: 100 96 Multi AV Scanner detection for domain / URL 2->96 98 Antivirus detection for URL or domain 2->98 100 Antivirus detection for dropped file 2->100 102 13 other signatures 2->102 10 file.exe 19 2->10         started        13 csrss.exe 2->13         started        15 csrss.exe 2->15         started        17 6 other processes 2->17 process3 signatures4 116 Detected unpacking (changes PE section rights) 10->116 118 Detected unpacking (overwrites its own PE header) 10->118 120 Modifies the windows firewall 10->120 122 Drops PE files with benign system names 10->122 19 file.exe 11 2 10->19         started        24 csrss.exe 13->24         started        26 csrss.exe 15->26         started        28 csrss.exe 17->28         started        process5 dnsIp6 78 humisnee.com 104.21.93.73, 443, 49747 CLOUDFLARENETUS United States 19->78 68 C:\Windows\rss\csrss.exe, PE32 19->68 dropped 104 Drops executables to the windows directory (C:\Windows) and starts them 19->104 106 Creates an autostart registry key pointing to binary in C:\Windows 19->106 30 csrss.exe 4 9 19->30         started        35 cmd.exe 1 19->35         started        file7 signatures8 process9 dnsIp10 80 spolaect.info 104.21.33.110, 443, 49752 CLOUDFLARENETUS United States 30->80 82 server5.sndvoices.com 104.21.38.22, 443, 49750, 49751 CLOUDFLARENETUS United States 30->82 84 3 other IPs or domains 30->84 70 C:\Windows\windefender.exe, PE32 30->70 dropped 72 C:\Windows\System32\drivers\Winmon.sys, PE32+ 30->72 dropped 74 C:\Users\user\AppData\Local\...\injector.exe, PE32+ 30->74 dropped 76 4 other files (none is malicious) 30->76 dropped 86 Antivirus detection for dropped file 30->86 88 Detected unpacking (changes PE section rights) 30->88 90 Detected unpacking (overwrites its own PE header) 30->90 94 4 other signatures 30->94 37 windefender.exe 30->37         started        40 injector.exe 30->40         started        42 schtasks.exe 1 30->42         started        48 5 other processes 30->48 92 Uses netsh to modify the Windows network and firewall settings 35->92 44 netsh.exe 3 35->44         started        46 conhost.exe 35->46         started        file11 signatures12 process13 signatures14 108 Antivirus detection for dropped file 37->108 110 Multi AV Scanner detection for dropped file 37->110 112 Machine Learning detection for dropped file 37->112 50 cmd.exe 37->50         started        52 conhost.exe 40->52         started        54 conhost.exe 42->54         started        114 Creates files in the system32 config directory 44->114 56 conhost.exe 48->56         started        58 conhost.exe 48->58         started        60 conhost.exe 48->60         started        62 2 other processes 48->62 process15 process16 64 conhost.exe 50->64         started        66 sc.exe 50->66         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/919a4877c1435674718c7ffd0c8c5ff7f5876be471fd8419875fb5dc1bdf3dd9/
Threat name:
Win32.Trojan.Caynamer
Create hunting rule
Status:
Malicious
First seen:
2021-05-23 17:44:10 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0de430b38bdccba626c6c0c5c8297057fd434ccc7a0d4c84bc066eb9dde07420
Glupteba
10ca39f81fb42e95a9dc694244aa826b0d7b8132a12e861732f59add8bb37256
Glupteba
129da3e565d7ab1c5e5c3705be3811b629e058be9af50d354bf7949605062416
Glupteba
1f9578b50263a8f756344b1f1a7c9d8b9e3dcc651aa34ec07bf46e8cc68470eb
Glupteba
397bfeb1261e2856bde7456470832206f54b77ef6a2ad5d1bda8c50a71cd2936
Glupteba
47708d669b31f626c8e3f1ad6c124da9601e2a2a5ad9bc3865038f985c89c696
Glupteba
4ae0156d1ccca584c5ed35708b150e0649cd470f5b192653a578c215e5118c08
Glupteba
9458e942802c493170321e2eb09fbbd9ecc928e85708c3b08475593e9c59abf2
Glupteba
b3ec750d8a6835841bf511e0c6f485cddc443f5c899b60bdc119d35df7870798
Glupteba
eeab7273fbf740c764fa5bc8ec2595919715dcff3fb91c45f7bfb6640bd2a9a0
Glupteba
+ 84 additional samples on MalwareBazaar
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:metasploit backdoor dropper loader trojan
Link:
https://tria.ge/reports/210523-mzq3qkmxn6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Glupteba
Glupteba Payload
MetaSploit
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
XPACK
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/919a4877c1435674718c7ffd0c8c5ff7f5876be471fd8419875fb5dc1bdf3dd9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Glupteba

Executable exe 919a4877c1435674718c7ffd0c8c5ff7f5876be471fd8419875fb5dc1bdf3dd9

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/160942/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-23 18:00:35 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
1) [B0012.001] Anti-Static Analysis::Argument Obfuscation
2) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
3) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
4) [C0049] File System Micro-objective::Get File Attributes
5) [C0051] File System Micro-objective::Read File
6) [C0052] File System Micro-objective::Writes File
7) [C0033] Operating System Micro-objective::Console
8) [C0040] Process Micro-objective::Allocate Thread Local Storage
9) [C0043] Process Micro-objective::Check Mutex
10) [C0041] Process Micro-objective::Set Thread Local Storage Value
11) [C0018] Process Micro-objective::Terminate Process
12) [C0039] Process Micro-objective::Terminate Thread