GluptebaMalware
Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.From MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 45 · each with the sentence it comes from- T1036Masquerading
“T1036 Masquerading”
- T1053.005Scheduled Task
“T1053.005 Scheduled Task”
- T1005Data from Local System
“T1005 Data from Local System”
- T1007System Service Discovery
“T1007 System Service Discovery”
- T1012Query Registry
“T1012 Query Registry”
- T1014Rootkit
“T1014 Rootkit”
What the reports say
2 reports, newest first · the exact sentence from each-
Exploring Windows UAC Bypasses: Techniques and Detection Strategies“Below is an example of Glupteba malware leveraging this method to first elevate from a Medium to High integrity process, then from High to System integrity via Token Manipulation:”
-
Package deal: Malware bundles causing disruption and damage across EMEA“Glupteba/RanumBot”
Indicators in its reports
named in the reports above- process[.]pein 1 report
- hxxps://github[.]com/hfiref0x/UACMEin 1 report
- hxxps://swapcontext.blogspot[.]com/2020/10/uacme-35-wd-and-ways-of-mitigation.htmlin 1 report
- swapcontext.blogspot[.]comin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.