MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d60c64e9104b55b04794bc7991675e4536317ebeb554c815e45181af2828332a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Glupteba


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d60c64e9104b55b04794bc7991675e4536317ebeb554c815e45181af2828332a
SHA3-384 hash: dc0c48c331cb0f3248164d36d89a1657ef2a30e1773ce339843cd75f1f5406e84d2cdf8d2873477fd4f744a3ddf370e0
SHA1 hash: d3811354ad78c5b0470448d917b84f2722c473a5
MD5 hash: 04548b9a041bd71c90586a09c9211a6e
humanhash: utah-xray-xray-mango
File name:https___thebabsite.com_app_app.exe
Download: download sample
Signature Glupteba
Create hunting rule
File size:4'089'856 bytes
First seen:2020-11-23 09:14:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 336d14fc1c0a5b9a47f63b9265b3ac60 (2 x Glupteba)
ssdeep 98304:j2di081RFGzwGIlZnh8ow8NuSjSRGasMB3A4+4LMGd9f:jr1R9T7uGSRGasM24+M
Threatray 42 similar samples on MalwareBazaar
TLSH C3163301AAE4F4BBD41407B0063EF0AA722EFC55B2F7CC8573EC57927E74162AA4B615
Reporter Racco42
Tags:exe Glupteba

Intelligence

File Origin
# of uploads :
1
# of downloads :
958
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Launching the process to change the firewall settings
Creating a file in the Windows subdirectories
Creating a process from a recently created file
DNS request
Creating a file
Sending a custom TCP request
Launching a process
Creating a file in the %temp% subdirectories
Moving a file to the %temp% subdirectory
Replacing files
Connection attempt
Moving a file to the system32 directory
Deleting a recently created file
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Launching a service
Running batch commands
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding exclusions to Windows Defender
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/544955
Signature
Antivirus / Scanner detection for submitted sample
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found Tor onion address
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS TXT record lookups
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321571 Sample: https___thebabsite.com_app_... Startdate: 23/11/2020 Architecture: WINDOWS Score: 100 33 thebabsite.com 2->33 35 server12.easywbdesign.com 2->35 37 2 other IPs or domains 2->37 41 Multi AV Scanner detection for domain / URL 2->41 43 Antivirus / Scanner detection for submitted sample 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 5 other signatures 2->47 7 https___thebabsite.com_app_app.exe 19 2->7         started        10 svchost.exe 2->10         started        12 svchost.exe 2->12         started        14 6 other processes 2->14 signatures3 process4 dnsIp5 49 Detected unpacking (changes PE section rights) 7->49 51 Detected unpacking (overwrites its own PE header) 7->51 17 WerFault.exe 7->17         started        19 WerFault.exe 7->19         started        21 WerFault.exe 7->21         started        29 12 other processes 7->29 53 Changes security center settings (notifications, updates, antivirus, firewall) 10->53 23 WerFault.exe 12->23         started        25 WerFault.exe 12->25         started        27 WerFault.exe 12->27         started        31 12 other processes 12->31 39 127.0.0.1 unknown unknown 14->39 signatures6 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d60c64e9104b55b04794bc7991675e4536317ebeb554c815e45181af2828332a/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 09:15:07 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yggj2iqjnk3ar4uxr4zcz26iu3dc7v6wvkmqfpekga26kbigmva._file
Verdict:
malicious
Similar samples:
2bec2f72f6ce8d9a9feb1b28a2da43a38d0ace472f3c5d0881e6c3e5886a2d3a
Glupteba
34c2eed8a266d3b5221bb51f0b5a59712b01d0b339a1db8f626688cb8fb81030
Glupteba
39264a6f15e8a51bab03924312a3dd05fc58a8d2b4aac39ca00e4cf16c9a21a9
Glupteba
482027d0e151826c175ff084f6e76ce4ca3a920ca648fc2d5906ed0a793fe8ad
Glupteba
5032244863d62238e00af2c69bf254fdb384fadb00972450472f66ddf00b5288
Glupteba
6ea5155a0572aed1cc6d535c2c9111a35aa20ee1c798a1eafaa0ced97b703e07
Glupteba
9272b247337fb357b642d0aa7227f2be68a965ad5cbc7b03810ca9052bbb84dc
Glupteba
9808a3875c36c7fc105ebba81213f9c108dbf12d65025752013ea2a2763578d6
Glupteba
f92deb731182f4a89fe3d358a5a5cd35ac180d2fc2e5da390e6dc77c41627c84
Glupteba
fbdcf6ebb76c84c3876adf6f8de5af5c1660aa090234f73b3af26ed15ab3ff9d
Glupteba
+ 32 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion persistence trojan upx
Link:
https://tria.ge/reports/201123-625ndn9the/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Launches sc.exe
Modifies service
Adds Run key to start application
Checks installed software on the system
JavaScript code in executable
Loads dropped DLL
Windows security modification
Drops file in Drivers directory
Executes dropped EXE
Modifies Windows Firewall
UPX packed file
Modifies boot configuration data using bcdedit
Windows security bypass
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
7134ab9350f2116e35ce1f7fc8da389fd5fd2d7c7fdd49ed923afbff1c534953
MD5 hash:
2c3339fb52a633609da9d0de1037ef85
SHA1 hash:
632e5f6393343e766587ffb3f56414ea6f65f97e
Link:
https://www.unpac.me/results/7b1a3263-fe59-4123-a193-7c8701758e6f/
SH256 hash:
d60c64e9104b55b04794bc7991675e4536317ebeb554c815e45181af2828332a
MD5 hash:
04548b9a041bd71c90586a09c9211a6e
SHA1 hash:
d3811354ad78c5b0470448d917b84f2722c473a5
Link:
https://www.unpac.me/results/7b1a3263-fe59-4123-a193-7c8701758e6f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
XPACK
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d60c64e9104b55b04794bc7991675e4536317ebeb554c815e45181af2828332a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glupteba
Create hunting rule
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:QnapCrypt
Create hunting rule
Author:Intezer Labs
Reference:https://www.intezer.com
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/105236/

Comments