MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f3ab2c5e5547a8bbd9bb223e322601873f1d53e5c2272989b85c759b6ac875c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Glupteba

Vendor detections: 12

Intelligence 12 IOCs YARA 25 File information Comments 1

SHA256 hash:	9f3ab2c5e5547a8bbd9bb223e322601873f1d53e5c2272989b85c759b6ac875c
SHA3-384 hash:	a9a37192c850d9ee665da70d2699c831919997e4587d7a184a8b5db47d13a58aea6a6af9207f3ed4399adc9d00b90b79
SHA1 hash:	7e70920b8063d8c192a934451b4c1362ab29bd0e
MD5 hash:	cc9e58ed1bcae82f769f3b55b18af80e
humanhash:	montana-autumn-yellow-failed
File name:	cc9e58ed1bcae82f769f3b55b18af80e
Download:	download sample
Signature	Glupteba Create hunting rule
File size:	4'386'688 bytes
First seen:	2023-05-27 08:31:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	697c6731df2df92c82c75859d21c5f77 (4 x Glupteba, 4 x Stop, 2 x Smoke Loader)
ssdeep	98304:/wwnuY/s3I4HHAgK5AvrW46hqyBPHtRMqZ37q:/Rnuw6Hc2rJeqyBPHtb2
Threatray	62 similar samples on MalwareBazaar
TLSH	T12716234382D07D95D56A8B33AE1ED6E8BB0EB6984E5E773732192EE714F0063C173291
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	1222420422020200 (3 x Glupteba)
Reporter	zbetcheckin
Tags:	32 exe Glupteba

Intelligence

File Origin

# of uploads :

# of downloads :

254

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

cc9e58ed1bcae82f769f3b55b18af80e

Verdict:

No threats detected

Analysis date:

2023-05-27 08:34:01 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6b9e40fb-5cc4-48eb-8b0c-2ee311863b99

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/392416/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a process with a hidden window

Sending a custom TCP request

Launching a service

Creating a file in the Windows subdirectories

Running batch commands

Launching the process to change the firewall settings

Сreating synchronization primitives

Searching for synchronization primitives

Using the Windows Management Instrumentation requests

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/6471c004ab097ab8405c03bf/reports/e97d7b70-5374-49e0-992d-f90fb05d42dc/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/9f3ab2c5e5547a8bbd9bb223e322601873f1d53e5c2272989b85c759b6ac875c

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dsefix

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ff4b3874-90df-443a-a117-ddf257d48f56

Result

Threat name:

Glupteba

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1243722

Signature

Antivirus detection for URL or domain

Creates an autostart registry key pointing to binary in C:\Windows

Creates files in the system32 config directory

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops executables to the windows directory (C:\Windows) and starts them

Drops PE files with benign system names

Found Tor onion address

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS TXT record lookups

Sigma detected: Schedule system process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Glupteba

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9f3ab2c5e5547a8bbd9bb223e322601873f1d53e5c2272989b85c759b6ac875c/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2023-05-27 08:32:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t45lfrpfkr5ixpm3wir6gitadbz7dvj6lqrhfge3qxdvtnvmq5oa._file

Verdict:

malicious

Result

Malware family:

glupteba

Score:

10/10

Tags:

family:glupteba discovery dropper evasion loader persistence rootkit trojan

Link:

https://tria.ge/reports/230527-ke97ksbc59/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Adds Run key to start application

Checks installed software on the system

Manipulates WinMon driver.

Manipulates WinMonFS driver.

Executes dropped EXE

Loads dropped DLL

Windows security modification

Drops file in Drivers directory

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Modifies boot configuration data using bcdedit

Glupteba

Glupteba payload

Windows security bypass

Gathering data

Malware family:

Glupteba

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9f3ab2c5e554/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f3ab2c5e5547a8bbd9bb223e322601873f1d53e5c2272989b85c759b6ac875c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	crime_ZZ_botnet_aicm Create hunting rule
Author:	imp0rtp3
Description:	DDoS Golang Botnet sample for linux called 'aicm'
Reference:	https://twitter.com/IntezerLabs/status/1401869234511175683

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	Glupteba Create hunting rule

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing artifcats associated with disabling Widnows Defender

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing URLs to raw contents of a Github gist

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many varying, potentially fake Windows User-Agents

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware

Rule name:	UroburosVirtualBoxDriver Create hunting rule

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	yara_template Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Glupteba

exe 9f3ab2c5e5547a8bbd9bb223e322601873f1d53e5c2272989b85c759b6ac875c

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/392416/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-05-27 08:31:41 UTC

url : hxxps://beelowers.com/6779d89b7a368f4f3f340b50a9d18d71.exe