MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94f593a07ee9a5168450fd8a67825cca582cfcb890cc758cc651550e46894e92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Glupteba


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94f593a07ee9a5168450fd8a67825cca582cfcb890cc758cc651550e46894e92
SHA3-384 hash: 9a6b8293886ab359ac839b36d7531427742102913556c23147e064508efac58e2189b79b9f39a110531bd56da4c8fe7f
SHA1 hash: 3fc4b07e10a869c64f63f5da0b03863e4dc8c65b
MD5 hash: 9615ab661d92bbc4b3fda0fe3739ade7
humanhash: lamp-spaghetti-muppet-three
File name:9615ab661d92bbc4b3fda0fe3739ade7
Download: download sample
Signature Glupteba
Create hunting rule
File size:7'902'720 bytes
First seen:2021-06-24 01:47:07 UTC
Last seen:2021-06-24 03:19:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1cd364a9e949d5ecebd6c614e64bc545 (16 x Glupteba, 10 x Snatch, 6 x CobaltStrike)
ssdeep 196608:v1oLBo8ywTbUGxa19aD0sSegGl31O301+:eB9xUfaDyGlF
Threatray 13 similar samples on MalwareBazaar
TLSH 7F863C13F8F204FAC7BEF0348591A722B971789943317F975F945A962A25FE07A2E310
Reporter zbetcheckin
Tags:exe Glupteba

Intelligence

File Origin
# of uploads :
2
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9615ab661d92bbc4b3fda0fe3739ade7
Verdict:
No threats detected
Analysis date:
2021-06-24 01:49:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ffe4e766-22cc-4485-90a0-a5b29481a99b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Bulz.518743.707.4096.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snatch Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c27d718-551b-47d0-8271-ab53c3299f51
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/807057
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94f593a07ee9a5168450fd8a67825cca582cfcb890cc758cc651550e46894e92/
Threat name:
Win64.Malware.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-06-17 07:26:01 UTC
File Type:
PE+ (Exe)
AV detection:
8 of 46 (17.39%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=st2zhid65gsrnbcq7wfgpas4zjmcz7fysdghldggkfkq4rujj2ja._file
Verdict:
malicious
Similar samples:
118e89d8135f0b7a40e9a886ebb89f8f9801d7d734559f0c1ec667322b933259
Glupteba
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593
Glupteba
40a2ace8bb6e3d7d50bb346344789c2fafd25490fdaa982134aaacce6f971995
Glupteba
463218064d1dfba957ebcbb0abb90782106f6e4b173e7b1c207b20a605ebbab9
Glupteba
4e002bce081442b7bc369d0a52eca3dba64d38649da8416863bd40b8bc3a49c7
Glupteba
690be9e806f882774ab1347302bd92236a16499f160f37e59992c220466493c0
Glupteba
8a99a4c58ef5e27d112f0efb4719abe01bcddb5e516114711ee4991f7922ab5f
Glupteba
d85188c58acb395ae88ad2be1f48044090eb03f125c97692c20787b933bbbd1a
Glupteba
e50d52fbac295a37f0ed0b724d4ddafca8c86bcd2391b4c481d51d5e279afd20
Glupteba
fefb3c7053a1332b03a4c0523862e8e387a5065b263cf10cb0d7f33f02afc646
Glupteba
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210624-2vw33f1l7s/
Unpacked files
SH256 hash:
94f593a07ee9a5168450fd8a67825cca582cfcb890cc758cc651550e46894e92
MD5 hash:
9615ab661d92bbc4b3fda0fe3739ade7
SHA1 hash:
3fc4b07e10a869c64f63f5da0b03863e4dc8c65b
Link:
https://www.unpac.me/results/9eade2b6-e7c7-430e-b1ba-d1670bf017a0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94f593a07ee9a5168450fd8a67825cca582cfcb890cc758cc651550e46894e92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glupteba
Create hunting rule
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:merlinAgent
Create hunting rule
Author:Hilko Bengen
Description:Detects Merlin agent
Reference:https://github.com/Ne0nd0g/merlin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Glupteba

Executable exe 94f593a07ee9a5168450fd8a67825cca582cfcb890cc758cc651550e46894e92

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1393234/

Comments