SYMBOLCOMMON_NAMEaka. SYNONYMS
win.glupteba (Back to overview)

Glupteba


Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.

References
2022-12-15NOZOMI Network LabsNozomi Networks Labs
@online{labs:20221215:tracking:8584547, author = {Nozomi Networks Labs}, title = {{Tracking Malicious Glupteba Activity Through the Blockchain}}, date = {2022-12-15}, organization = {NOZOMI Network Labs}, url = {https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain/}, language = {English}, urldate = {2023-01-18} } Tracking Malicious Glupteba Activity Through the Blockchain
Glupteba
2022-09-15SekoiaThreat & Detection Research Team
@online{team:20220915:privateloader:d88c7b2, author = {Threat & Detection Research Team}, title = {{PrivateLoader: the loader of the prevalent ruzki PPI service}}, date = {2022-09-15}, organization = {Sekoia}, url = {https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/}, language = {English}, urldate = {2022-09-19} } PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-06-28KrebsOnSecurityBrian Krebs
@online{krebs:20220628:link:355a5e2, author = {Brian Krebs}, title = {{The Link Between AWM Proxy & the Glupteba Botnet}}, date = {2022-06-28}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/?utm_source=dlvr.it&utm_medium=twitter}, language = {English}, urldate = {2022-08-15} } The Link Between AWM Proxy & the Glupteba Botnet
Glupteba
2022-03-23The Hacker NewsRavie Lakshmanan
@online{lakshmanan:20220323:abuse:6b8c004, author = {Ravie Lakshmanan}, title = {{abuse mikrotik router by GLUPTEBA malware}}, date = {2022-03-23}, organization = {The Hacker News}, url = {https://thehackernews.com/2022/03/over-200000-microtik-routers-worldwide.html}, language = {English}, urldate = {2022-03-28} } abuse mikrotik router by GLUPTEBA malware
Glupteba Proxy Glupteba
2022-03-18AvastMartin Hron
@online{hron:20220318:mris:47b15bc, author = {Martin Hron}, title = {{Mēris and TrickBot standing on the shoulders of giants}}, date = {2022-03-18}, organization = {Avast}, url = {https://decoded.avast.io/martinhron/meris-and-trickbot-standing-on-the-shoulders-of-giants/}, language = {English}, urldate = {2022-03-23} } Mēris and TrickBot standing on the shoulders of giants
Glupteba Proxy Glupteba TrickBot
2022-01-19ChainanalysisChainalysis Team
@online{team:20220119:meet:b0e3f43, author = {Chainalysis Team}, title = {{Meet the Malware Families Helping Hackers Steal and Mine Millions in Cryptocurrency}}, date = {2022-01-19}, organization = {Chainanalysis}, url = {https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/}, language = {English}, urldate = {2022-01-24} } Meet the Malware Families Helping Hackers Steal and Mine Millions in Cryptocurrency
Glupteba RedLine Stealer
2021-12-07GoogleRoyal Hansen, Halimah DeLaine Prado
@online{hansen:20211207:new:d707355, author = {Royal Hansen and Halimah DeLaine Prado}, title = {{New action to combat cyber crime}}, date = {2021-12-07}, organization = {Google}, url = {https://blog.google/technology/safety-security/new-action-combat-cyber-crime/}, language = {English}, urldate = {2021-12-08} } New action to combat cyber crime
Glupteba
2021-12-07GoogleGoogle
@techreport{google:20211207:complaint:f4ad8d1, author = {Google}, title = {{Complaint for Damages and Injunctive Relief against DMITRY STAROVIKOV and ALEXANDER FILIPPOV}}, date = {2021-12-07}, institution = {Google}, url = {https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/1_Complaint.pdf}, language = {English}, urldate = {2021-12-08} } Complaint for Damages and Injunctive Relief against DMITRY STAROVIKOV and ALEXANDER FILIPPOV
Glupteba
2021-12-07GoogleShane Huntley, Luca Nagy, Google Threat Analysis Group
@online{huntley:20211207:disrupting:9fd4ab7, author = {Shane Huntley and Luca Nagy and Google Threat Analysis Group}, title = {{Disrupting the Glupteba operation}}, date = {2021-12-07}, organization = {Google}, url = {https://blog.google/threat-analysis-group/disrupting-glupteba-operation/}, language = {English}, urldate = {2021-12-08} } Disrupting the Glupteba operation
Glupteba
2021-10-15Trend MicroFernando Mercês
@online{mercs:20211015:ransomware:c944933, author = {Fernando Mercês}, title = {{Ransomware Operators Found Using New "Franchise" Business Model}}, date = {2021-10-15}, organization = {Trend Micro}, url = {https://www.trendmicro.com/en_us/research/21/j/ransomware-operators-found-using-new-franchise-business-model.html}, language = {English}, urldate = {2021-10-24} } Ransomware Operators Found Using New "Franchise" Business Model
Glupteba IcedID Mount Locker
2021-09-20Rostelecom-SolarRostelecom-Solar
@online{rostelecomsolar:20210920:how:cfe97c4, author = {Rostelecom-Solar}, title = {{How we searched for a connection between Mēris and Glupteba, and gained control over 45 thousand MikroTik devices}}, date = {2021-09-20}, organization = {Rostelecom-Solar}, url = {https://habr.com/ru/company/solarsecurity/blog/578900/}, language = {Russian}, urldate = {2021-09-22} } How we searched for a connection between Mēris and Glupteba, and gained control over 45 thousand MikroTik devices
Glupteba
2021-09-08RiskIQJennifer Grob
@online{grob:20210908:bulletproof:902e9f2, author = {Jennifer Grob}, title = {{Bulletproof Hosting Services: Investigating Flowspec}}, date = {2021-09-08}, organization = {RiskIQ}, url = {https://community.riskiq.com/article/2a36a7d2/description}, language = {English}, urldate = {2021-09-10} } Bulletproof Hosting Services: Investigating Flowspec
Azorult Glupteba
2021-07-19BitdefenderBitdefender
@techreport{bitdefender:20210719:debugging:48353a0, author = {Bitdefender}, title = {{Debugging MosaicLoader, One Step at a Time}}, date = {2021-07-19}, institution = {Bitdefender}, url = {https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf}, language = {English}, urldate = {2021-07-20} } Debugging MosaicLoader, One Step at a Time
AsyncRAT Glupteba
2021-06-04K7 SecurityMary Muthu Francisca
@online{francisca:20210604:glupteba:f7ec1dc, author = {Mary Muthu Francisca}, title = {{Glupteba back on track spreading via EternalBlue exploits}}, date = {2021-06-04}, organization = {K7 Security}, url = {https://labs.k7computing.com/?p=22319}, language = {English}, urldate = {2021-06-21} } Glupteba back on track spreading via EternalBlue exploits
Glupteba
2021-02-25IntezerIntezer
@techreport{intezer:20210225:year:eb47cd1, author = {Intezer}, title = {{Year of the Gopher A 2020 Go Malware Round-Up}}, date = {2021-02-25}, institution = {Intezer}, url = {https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf}, language = {English}, urldate = {2021-06-30} } Year of the Gopher A 2020 Go Malware Round-Up
NiuB WellMail elf.wellmess ArdaMax AsyncRAT CyberGate DarkComet Glupteba Nanocore RAT Nefilim NjRAT Quasar RAT WellMess Zebrocy
2020-12-02DomainToolsJoe Slowik
@online{slowik:20201202:identifying:8ac64c3, author = {Joe Slowik}, title = {{Identifying Network Infrastructure Related to a World Health Organization Spoofing Campaign}}, date = {2020-12-02}, organization = {DomainTools}, url = {https://www.domaintools.com/resources/blog/identifying-network-infrastructure-related-to-a-who-spoofing-campaign}, language = {English}, urldate = {2020-12-08} } Identifying Network Infrastructure Related to a World Health Organization Spoofing Campaign
Azorult Glupteba
2020-06-24Sophos Naked SecurityPaul Ducklin
@online{ducklin:20200624:glupteba:8f0c66a, author = {Paul Ducklin}, title = {{Glupteba - the malware that gets secret messages from the Bitcoin blockchain}}, date = {2020-06-24}, organization = {Sophos Naked Security}, url = {https://nakedsecurity.sophos.com/2020/06/24/glupteba-the-bot-that-gets-secret-messages-from-the-bitcoin-blockchain/}, language = {English}, urldate = {2020-06-26} } Glupteba - the malware that gets secret messages from the Bitcoin blockchain
Glupteba
2020-06-24Sophos LabsAndrew Brandt
@online{brandt:20200624:glupteba:fc4095d, author = {Andrew Brandt}, title = {{Glupteba malware hides in plain sight}}, date = {2020-06-24}, organization = {Sophos Labs}, url = {https://news.sophos.com/en-us/2020/06/24/glupteba-report/?cmp=30728}, language = {English}, urldate = {2020-06-24} } Glupteba malware hides in plain sight
Glupteba
2020-04-13Dissecting MalwareMarius Genheimer
@online{genheimer:20200413:blame:b258b2b, author = {Marius Genheimer}, title = {{The Blame Game - About False Flags and overwritten MBRs}}, date = {2020-04-13}, organization = {Dissecting Malware}, url = {https://dissectingmalwa.re/the-blame-game-about-false-flags-and-overwritten-mbrs.html}, language = {English}, urldate = {2020-04-15} } The Blame Game - About False Flags and overwritten MBRs
Glupteba MBR Locker
2020-02-07Medium CSIS TechblogBenoît Ancel
@online{ancel:20200207:installcapital:23b3760, author = {Benoît Ancel}, title = {{InstallCapital — When AdWare Becomes Pay-per-Install Cyber-Crime}}, date = {2020-02-07}, organization = {Medium CSIS Techblog}, url = {https://medium.com/csis-techblog/installcapital-when-adware-becomes-pay-per-install-cyber-crime-15516249a451}, language = {English}, urldate = {2020-02-09} } InstallCapital — When AdWare Becomes Pay-per-Install Cyber-Crime
DreamBot Glupteba
2019-09-04Trend MicroJaromír Hořejší, Joseph C. Chen
@online{hoej:20190904:glupteba:230e916, author = {Jaromír Hořejší and Joseph C. Chen}, title = {{Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions}}, date = {2019-09-04}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/glupteba-campaign-hits-network-routers-and-updates-cc-servers-with-data-from-bitcoin-transactions/}, language = {English}, urldate = {2020-01-10} } Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions
Glupteba
2018-03-22ESET ResearchFrédéric Vachon
@online{vachon:20180322:glupteba:10f0116, author = {Frédéric Vachon}, title = {{Glupteba is no longer part of Windigo}}, date = {2018-03-22}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2018/03/22/glupteba-no-longer-windigo/}, language = {English}, urldate = {2019-11-14} } Glupteba is no longer part of Windigo
Glupteba
2014-03-18ESET ResearchPierre-Marc Bureau
@online{bureau:20140318:operation:1b1bd17, author = {Pierre-Marc Bureau}, title = {{Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign}}, date = {2014-03-18}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/}, language = {English}, urldate = {2019-11-14} } Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign
Boaxxe Glupteba
2011-03-02ESET ResearchDavid Harley
@online{harley:20110302:tdl4:9071c3f, author = {David Harley}, title = {{TDL4 and Glupteba: Piggyback PiggyBugs}}, date = {2011-03-02}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2011/03/02/tdl4-and-glubteba-piggyback-piggybugs/}, language = {English}, urldate = {2019-11-14} } TDL4 and Glupteba: Piggyback PiggyBugs
Glupteba
Yara Rules
[TLP:WHITE] win_glupteba_auto (20230125 | Detects win.glupteba.)
rule win_glupteba_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.glupteba."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83c410 85c0 0f8419010000 b800040000 }
            // n = 4, score = 400
            //   83c410               | add                 esp, 0x10
            //   85c0                 | test                eax, eax
            //   0f8419010000         | je                  0x11f
            //   b800040000           | mov                 eax, 0x400

        $sequence_1 = { 5f 5e 5d 5b 8b442400 59 c3 }
            // n = 7, score = 400
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   5b                   | pop                 ebx
            //   8b442400             | mov                 eax, dword ptr [esp]
            //   59                   | pop                 ecx
            //   c3                   | ret                 

        $sequence_2 = { 0bfb 33f7 8b7df4 c1e708 0b7dfc 8bda c1e708 }
            // n = 7, score = 400
            //   0bfb                 | or                  edi, ebx
            //   33f7                 | xor                 esi, edi
            //   8b7df4               | mov                 edi, dword ptr [ebp - 0xc]
            //   c1e708               | shl                 edi, 8
            //   0b7dfc               | or                  edi, dword ptr [ebp - 4]
            //   8bda                 | mov                 ebx, edx
            //   c1e708               | shl                 edi, 8

        $sequence_3 = { 7668 8b5d08 8a03 84c0 745f 3c20 7505 }
            // n = 7, score = 400
            //   7668                 | jbe                 0x6a
            //   8b5d08               | mov                 ebx, dword ptr [ebp + 8]
            //   8a03                 | mov                 al, byte ptr [ebx]
            //   84c0                 | test                al, al
            //   745f                 | je                  0x61
            //   3c20                 | cmp                 al, 0x20
            //   7505                 | jne                 7

        $sequence_4 = { 85c0 7561 0fb74508 50 68???????? 8d45f4 50 }
            // n = 7, score = 400
            //   85c0                 | test                eax, eax
            //   7561                 | jne                 0x63
            //   0fb74508             | movzx               eax, word ptr [ebp + 8]
            //   50                   | push                eax
            //   68????????           |                     
            //   8d45f4               | lea                 eax, [ebp - 0xc]
            //   50                   | push                eax

        $sequence_5 = { 315df8 891f 895df4 8b5df8 }
            // n = 4, score = 400
            //   315df8               | xor                 dword ptr [ebp - 8], ebx
            //   891f                 | mov                 dword ptr [edi], ebx
            //   895df4               | mov                 dword ptr [ebp - 0xc], ebx
            //   8b5df8               | mov                 ebx, dword ptr [ebp - 8]

        $sequence_6 = { 317df8 8b7df0 8b5df8 c1e708 0b7dfc }
            // n = 5, score = 400
            //   317df8               | xor                 dword ptr [ebp - 8], edi
            //   8b7df0               | mov                 edi, dword ptr [ebp - 0x10]
            //   8b5df8               | mov                 ebx, dword ptr [ebp - 8]
            //   c1e708               | shl                 edi, 8
            //   0b7dfc               | or                  edi, dword ptr [ebp - 4]

        $sequence_7 = { 50 53 be???????? 56 ff15???????? 6aff 56 }
            // n = 7, score = 400
            //   50                   | push                eax
            //   53                   | push                ebx
            //   be????????           |                     
            //   56                   | push                esi
            //   ff15????????         |                     
            //   6aff                 | push                -1
            //   56                   | push                esi

        $sequence_8 = { 00cd 3e46 005e3e 46 }
            // n = 4, score = 100
            //   00cd                 | add                 ch, cl
            //   3e46                 | inc                 esi
            //   005e3e               | add                 byte ptr [esi + 0x3e], bl
            //   46                   | inc                 esi

        $sequence_9 = { 0106 830702 392e 75a0 }
            // n = 4, score = 100
            //   0106                 | add                 dword ptr [esi], eax
            //   830702               | add                 dword ptr [edi], 2
            //   392e                 | cmp                 dword ptr [esi], ebp
            //   75a0                 | jne                 0xffffffa2

        $sequence_10 = { 0107 eb4d 8b02 89442418 }
            // n = 4, score = 100
            //   0107                 | add                 dword ptr [edi], eax
            //   eb4d                 | jmp                 0x4f
            //   8b02                 | mov                 eax, dword ptr [edx]
            //   89442418             | mov                 dword ptr [esp + 0x18], eax

        $sequence_11 = { 0012 3f 46 008bff558bec }
            // n = 4, score = 100
            //   0012                 | add                 byte ptr [edx], dl
            //   3f                   | aas                 
            //   46                   | inc                 esi
            //   008bff558bec         | add                 byte ptr [ebx - 0x1374aa01], cl

        $sequence_12 = { 005e3e 46 00ff 3e46 }
            // n = 4, score = 100
            //   005e3e               | add                 byte ptr [esi + 0x3e], bl
            //   46                   | inc                 esi
            //   00ff                 | add                 bh, bh
            //   3e46                 | inc                 esi

        $sequence_13 = { 00ff 3e46 0012 3f }
            // n = 4, score = 100
            //   00ff                 | add                 bh, bh
            //   3e46                 | inc                 esi
            //   0012                 | add                 byte ptr [edx], dl
            //   3f                   | aas                 

        $sequence_14 = { 0101 03d3 8b4620 8bcb }
            // n = 4, score = 100
            //   0101                 | add                 dword ptr [ecx], eax
            //   03d3                 | add                 edx, ebx
            //   8b4620               | mov                 eax, dword ptr [esi + 0x20]
            //   8bcb                 | mov                 ecx, ebx

        $sequence_15 = { 00f1 3d46005e3e 46 00cd }
            // n = 4, score = 100
            //   00f1                 | add                 cl, dh
            //   3d46005e3e           | cmp                 eax, 0x3e5e0046
            //   46                   | inc                 esi
            //   00cd                 | add                 ch, cl

    condition:
        7 of them and filesize < 1417216
}
Download all Yara Rules