MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Glupteba

Vendor detections: 13

Intelligence 13 IOCs YARA 32 File information Comments

SHA256 hash:	aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454
SHA3-384 hash:	201fc78bc75b1bd3a443d87b3861e1a430b990855ad77ecd60daef8eae2d70a8cb563a4bd6da4969ee6f3df6ffc74978
SHA1 hash:	560812cb44f6735cf25e231e33f78bc71533ae19
MD5 hash:	a39126235228235075af3277a13e4397
humanhash:	august-blue-missouri-pluto
File name:	delta.exe
Download:	download sample
Signature	Glupteba Create hunting rule
File size:	9'402'880 bytes
First seen:	2025-03-22 22:44:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4f2f006e2ecf7172ad368f8289dc96c1 (179 x SalatStealer, 40 x LummaStealer, 17 x CobaltStrike)
ssdeep	98304:UuakRejm4wbn0blIURXTnzGx+kpfhycxmEzN/cOTEe:8M/bn0blIUkLyKzN/c
TLSH	T116962947ECA546E4C0EAD575CA669653BE713C884B3063D36B50F7282F37BD0AAB9700
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10522/11/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	aachum
Tags:	exe Glupteba PentagonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

443

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

delta.exe

Verdict:

Malicious activity

Analysis date:

2025-02-23 16:33:17 UTC

Tags:

stealer golang

Link:

https://app.any.run/tasks/ee0a809d-1d42-4074-aa15-83a5ae6be6cb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67bb4dce28ab76d43a5cbb91

Tags:

infosteal crypt spawn sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Creating a file

Creating a file in the %AppData% subdirectories

Launching a tool to kill processes

Forced shutdown of a browser

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

crypto golang

Link:

https://www.filescan.io/uploads/67df3d48fae452b82c210d86/reports/15127375-b30c-4ace-9e1c-04c77b6bbc24/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d7e0a63a-2e17-44ec-8bf3-b361b433c679

Result

Threat name:

Go Stealer

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1645917

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found many strings related to Crypto-Wallets (likely being stolen)

Found Tor onion address

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Overwrites Mozilla Firefox settings

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Go Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

80%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454/

Threat name:

Win32.Exploit.Generic

Status:

Malicious

First seen:

2025-02-23 16:33:18 UTC

File Type:

PE+ (Exe)

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=v73pymtpjnfpiocwihqykuefq3a442qnrzi2lhffvbnycdtikrka._file

Result

Malware family:

pentagonstealer

Score:

10/10

Tags:

family:pentagonstealer credential_access discovery spyware stealer

Link:

https://tria.ge/reports/250322-2nv8fssvbs/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Uses browser remote debugging

Malware Config

C2 Extraction:

https://pentagon.cy

Gathering data

Unpacked files

SH256 hash:

aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454

MD5 hash:

a39126235228235075af3277a13e4397

SHA1 hash:

560812cb44f6735cf25e231e33f78bc71533ae19

Link:

https://www.unpac.me/results/04b54ca6-9178-45e6-8098-7f9d1ef99dd0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	aix Create hunting rule
Author:	Tim Brown @timb_machine
Description:	AIX binary

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	enterpriseunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise UNIX

Rule name:	Glupteba Create hunting rule

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	Multi_Generic_Threat_19854dc2 Create hunting rule
Author:	Elastic Security

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Glupteba

exe aff6fc326f4b4af4385641e185508586c1ce6a0d8e51a59ca5a85b810e685454

(this sample)

Link

https://tria.ge/250223-t2l8pstqy7

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryW kernel32.dll::LoadLibraryExW kernel32.dll::GetSystemInfo
WIN_BASE_EXEC_API	Can Execute other programs	kernel32.dll::WriteConsoleW kernel32.dll::SetConsoleCtrlHandler kernel32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::GetSystemDirectoryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample