MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ae9dec17418ed06f57af2df42fc52c285416996c460115ad3a5d8929f0867951. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Glupteba
Vendor detections: 11
| SHA256 hash: | ae9dec17418ed06f57af2df42fc52c285416996c460115ad3a5d8929f0867951 |
|---|---|
| SHA3-384 hash: | 4feabb8253b1b5211ad5296d38b814d759137ea2c458c20a9f5dfdcfe95d3ce54ef4ef4b50f9a192085a6b7ca6ba01dc |
| SHA1 hash: | 7c2538dcc5b924bfed76264942b6c4520fa58e0e |
| MD5 hash: | 86fbe010876ea39d16d7d411c51ec37e |
| humanhash: | red-south-fix-network |
| File name: | file |
| Download: | download sample |
| Signature | Glupteba |
| File size: | 2'848'112 bytes |
| First seen: | 2023-12-01 01:23:26 UTC |
| Last seen: | 2023-12-01 15:05:21 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 49152:Y2uRLlySeEPbnfQz9YdBZG3e/9iIcWz7ViTBl+MpXYoz2HLMH+aR3M3:Yy6Tnq8ZecQ8Sl+fCOgH+O3C |
| Threatray | 10 similar samples on MalwareBazaar |
| TLSH | T15BD5E05F8028EF100DA524B72B9B0290AEB81DCC4075E37196D5B46DF9F880FDE79E99 |
| TrID | 30.2% (.EXE) Win64 Executable (generic) (10523/12/4) 18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.9% (.EXE) Win32 Executable (generic) (4505/5/1) 5.9% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  andretavare5 |
| Tags: | exe Glupteba signed |
Code Signing Certificate
| Organisation: | wabpik inc |
|---|---|
| Issuer: | wabpik inc |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2023-12-01T00:49:59Z |
| Valid to: | 2024-12-01T00:49:59Z |
| Serial number: | b4e784a86c542f8dca069bbf7c8e7dee |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | 2dfeec383c90208f59e5efbc36e25407349dd8c7d78e9eb8b292b8db7fd87134 |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
13
# of downloads :
340
Origin country :
USVendor Threat Intelligence
Detection:
n/a
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Creating a file
DNS request
Sending an HTTP GET request
Creating a process from a recently created file
Creating a file in the %temp% directory
Searching for synchronization primitives
Searching for the window
Creating a file in the %AppData% subdirectories
Moving a recently created file
Using the Windows Management Instrumentation requests
Launching the process to interact with network services
Blocking the User Account Control
Adding exclusions to Windows Defender
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Malware family:
Upgdsed
Verdict:
Malicious
Result
Threat name:
Glupteba
Detection:
malicious
Classification:
rans.troj.expl.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Privateloader
Status:
Malicious
First seen:
2023-12-01 01:24:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
16 of 23 (69.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
vidar
Score:
10/10
Tags:
family:glupteba family:vidar botnet:12c2d61a6798c01d07f5c4638a3ba698 discovery dropper evasion loader persistence rootkit spyware stealer trojan upx
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Uses Task Scheduler COM API
NSIS installer
Enumerates physical storage devices
Program crash
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Manipulates WinMon driver.
Manipulates WinMonFS driver.
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Registers COM server for autorun
UPX packed file
Windows security modification
Downloads MZ/PE file
Drops file in Drivers directory
Modifies Windows Firewall
Possible attempt to disable PatchGuard
Modifies boot configuration data using bcdedit
Glupteba
Glupteba payload
UAC bypass
Vidar
Windows security bypass
Malware Config
C2 Extraction:
https://t.me/s4p0g
https://steamcommunity.com/profiles/76561199575355834
https://steamcommunity.com/profiles/76561199575355834
Unpacked files
SH256 hash:
a7563db98efb7fd02dd373104fd6dbe6e8b52e0284ad71459f6a1c0af68598c0
MD5 hash:
04b9144af842a6c3ea2c738b50ce2a88
SHA1 hash:
4e5addb95a7dea4ee8d935c6108ec169e88edf66
SH256 hash:
ae9dec17418ed06f57af2df42fc52c285416996c460115ad3a5d8929f0867951
MD5 hash:
86fbe010876ea39d16d7d411c51ec37e
SHA1 hash:
7c2538dcc5b924bfed76264942b6c4520fa58e0e
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.53
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | pe_imphash |
|---|
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Dropped by
PrivateLoader
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.