MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e88ff3e11f1c3394870ae00daaf2b3b26c931ac47238c377f10bcf4168b486a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Glupteba


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e88ff3e11f1c3394870ae00daaf2b3b26c931ac47238c377f10bcf4168b486a1
SHA3-384 hash: cfde84a02564b41b818c377a2de4874e372054e49693c78f1be7fcec8c049021e0b14bc794cf06970b381d26c4889659
SHA1 hash: a1a5e261c7a2a2cdb8fb7c0c474afd6c9e143f51
MD5 hash: 4e09f5f62eaec1f7c564f2d8c058a33e
humanhash: speaker-echo-three-mobile
File name:SecuriteInfo.com.Generic.mg.4e09f5f62eaec1f7.16149
Download: download sample
Signature Glupteba
Create hunting rule
File size:3'957'760 bytes
First seen:2020-08-26 13:43:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a8037be2c928248acd063f61ed80e0f7 (1 x Glupteba)
ssdeep 98304:DRHcrqLk0ESLusOqMFjTpKGE60wTqQ5XuTwbGJa:Nm0ECNXmj1n0wTqQ5Xtka
Threatray 34 similar samples on MalwareBazaar
TLSH 330633D070E09177DE1AA1776B1A87BB7C98B968350E02E3971C5AAE6F103F2167D343
Reporter SecuriteInfoCom
Tags:Glupteba

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'127
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51266/
Detection(s):
SecuriteInfo.com.Generic.mg.4e09f5f62eaec1f7.16149.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Launching a service
Running batch commands
Creating a process with a hidden window
Launching the process to change the firewall settings
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a file
DNS request
Launching a process
Sending a custom TCP request
Creating a file in the %temp% subdirectories
Moving a file to the %temp% subdirectory
Replacing files
Connection attempt
Moving a file to the system32 directory
Deleting a recently created file
Creating a file in the drivers directory
Creating a service
Loading a system driver
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Adding exclusions to Windows Defender
Enabling autorun by creating a file
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/451739
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Creates files in the system32 config directory
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Sigma detected: Schedule CERTUTIL windows binary
Sigma detected: Suspicious Certutil Command
Sigma detected: System File Execution Location Anomaly
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses bcdedit to modify the Windows boot settings
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 278381 Sample: SecuriteInfo.com.Generic.mg... Startdate: 27/08/2020 Architecture: WINDOWS Score: 100 70 easywbdesign.com 2->70 72 bbistrovantonbb.com 2->72 82 Multi AV Scanner detection for domain / URL 2->82 84 Antivirus detection for dropped file 2->84 86 Antivirus / Scanner detection for submitted sample 2->86 88 13 other signatures 2->88 10 SecuriteInfo.com.Generic.mg.4e09f5f62eaec1f7.exe 19 2->10         started        13 csrss.exe 2 2->13         started        15 svchost.exe 9 1 2->15         started        18 10 other processes 2->18 signatures3 process4 dnsIp5 98 Detected unpacking (changes PE section rights) 10->98 100 Detected unpacking (overwrites its own PE header) 10->100 102 Drops PE files with benign system names 10->102 20 SecuriteInfo.com.Generic.mg.4e09f5f62eaec1f7.exe 13 2 10->20         started        24 cmd.exe 13->24         started        80 127.0.0.1 unknown unknown 15->80 26 conhost.exe 18->26         started        signatures6 process7 file8 62 C:\Windows\rss\csrss.exe, PE32 20->62 dropped 90 Drops executables to the windows directory (C:\Windows) and starts them 20->90 92 Creates an autostart registry key pointing to binary in C:\Windows 20->92 28 csrss.exe 3 4 20->28         started        33 cmd.exe 1 20->33         started        35 cmd.exe 1 20->35         started        37 conhost.exe 24->37         started        signatures9 process10 dnsIp11 74 62429c3d-c590-41f8-8ce8-c136e91d2c99.server4.easywbdesign.com 172.64.169.35, 443, 49726, 49727 CLOUDFLARENETUS United States 28->74 76 bbistrovantonbb.com 172.67.154.90, 443, 49733, 49734 CLOUDFLARENETUS United States 28->76 78 192.168.2.1 unknown unknown 28->78 64 C:\Windows\System32\drivers\Winmon.sys, PE32+ 28->64 dropped 66 C:\Users\user\AppData\Local\...\patch.exe, PE32+ 28->66 dropped 68 C:\Users\user\AppData\Local\...\dsefix.exe, PE32+ 28->68 dropped 104 Antivirus detection for dropped file 28->104 106 Detected unpacking (changes PE section rights) 28->106 108 Detected unpacking (overwrites its own PE header) 28->108 110 3 other signatures 28->110 39 patch.exe 28->39         started        42 schtasks.exe 1 28->42         started        44 schtasks.exe 1 28->44         started        46 bcdedit.exe 28->46         started        48 netsh.exe 3 33->48         started        50 conhost.exe 33->50         started        52 netsh.exe 3 35->52         started        54 conhost.exe 35->54         started        file12 signatures13 process14 signatures15 94 Multi AV Scanner detection for dropped file 39->94 56 conhost.exe 42->56         started        58 conhost.exe 44->58         started        60 conhost.exe 46->60         started        96 Creates files in the system32 config directory 48->96 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e88ff3e11f1c3394870ae00daaf2b3b26c931ac47238c377f10bcf4168b486a1/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-26 11:44:27 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ch7hyi7dqzzjbyk4ag2v4vtwjwjggweoi4mg57rbphuc2fuq2qq._file
Verdict:
malicious
Similar samples:
34c2eed8a266d3b5221bb51f0b5a59712b01d0b339a1db8f626688cb8fb81030
Glupteba
39264a6f15e8a51bab03924312a3dd05fc58a8d2b4aac39ca00e4cf16c9a21a9
Glupteba
5032244863d62238e00af2c69bf254fdb384fadb00972450472f66ddf00b5288
Glupteba
6ea5155a0572aed1cc6d535c2c9111a35aa20ee1c798a1eafaa0ced97b703e07
Glupteba
86fce58f93e4087e261c52befbb872ddafeb8129008d5153c90084cd4a4a45d0
Glupteba
9808a3875c36c7fc105ebba81213f9c108dbf12d65025752013ea2a2763578d6
Glupteba
9f0c58f568c713eb2a7fc4836806a3e70bcdb41d05bfc75a1f815c64d856afde
Glupteba
c006abbb1bae333e5973f9c419bfd9c3c721698cf2cf3ffbd1048fdfb4de811b
Glupteba
cb1ffa5cd81d50702ee7296cd788a66fa8d5aa422e5cb4cdaca5a2ea4322141f
Glupteba
f4be8a038fc4b681a850d8ecaecc1f663d41bf27daf4f1af9c4cee1a3f63ae1a
Glupteba
+ 24 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan persistence discovery
Link:
https://tria.ge/reports/200826-wdsmgg15fn/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Launches sc.exe
Drops file in Windows directory
Modifies service
Adds Run key to start application
Checks installed software on the system
JavaScript code in executable
Adds Run key to start application
Checks installed software on the system
Loads dropped DLL
Windows security modification
Loads dropped DLL
Windows security modification
Drops file in Drivers directory
Executes dropped EXE
Modifies Windows Firewall
UPX packed file
Drops file in Drivers directory
Executes dropped EXE
Modifies Windows Firewall
Modifies boot configuration data using bcdedit
Modifies boot configuration data using bcdedit
Windows security bypass
Suspicious use of NtCreateUserProcessOtherParentProcess
Windows security bypass
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MalPE
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e88ff3e11f1c3394870ae00daaf2b3b26c931ac47238c377f10bcf4168b486a1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Glupteba

Executable exe e88ff3e11f1c3394870ae00daaf2b3b26c931ac47238c377f10bcf4168b486a1

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/51266/
  
URLhaus
https://urlhaus.abuse.ch/url/444330/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/444326/

Comments