File name: | 5de8251f5a294399f426.zip |
Full analysis: | https://app.any.run/tasks/c33bfc73-8ca6-4edb-94d9-9ff8f6db2a83 |
Verdict: | Malicious activity |
Threats: | Glupteba is a loader with information-stealing and traffic routing functionality. It is designed primarily to install other viruses on infected PCs but can do much more than that. In addition, it is being constantly updated, making this virus one to watch out for. |
Analysis date: | December 06, 2019, 15:18:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 867D9CFB77FDB69ED8AFA4384FFC567B |
SHA1: | 697BC2EA140D61E46BE527C91DE1C01F995CBC41 |
SHA256: | 3F4135F4E25CD8758E790A8AF077C941FE3507ED962A297949771277C4F4F010 |
SSDEEP: | 98304:TZv7VDyN/assfzc+KXppxLU3EMrpnMn1h+EhkNnGeF2:Fv7R0/+7pUy3HNnMn1h+EhwnfY |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 788 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:12:06 15:17:20 |
ZipCRC: | 0x0e029957 |
ZipCompressedSize: | 3885749 |
ZipUncompressedSize: | 3948544 |
ZipFileName: | 5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.bin |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1504 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\5de8251f5a294399f426.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
3036 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2648 | "C:\Users\admin\Downloads\5de8251f5a294399f426\5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.exe" | C:\Users\admin\Downloads\5de8251f5a294399f426\5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
2832 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 3221225547 Version: 75.0.3770.100 Modules
| |||||||||||||||
2128 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6d36a9d0,0x6d36a9e0,0x6d36a9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
2724 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2264 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
3600 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,12181726150853866778,6159934540760781367,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=9447303748843514115 --mojo-platform-channel-handle=1012 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
3964 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1016,12181726150853866778,6159934540760781367,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=12527737499578799595 --mojo-platform-channel-handle=1620 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
1712 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,12181726150853866778,6159934540760781367,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3437435562672046941 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
1416 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,12181726150853866778,6159934540760781367,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10017313642269487386 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old | — | |
MD5:— | SHA256:— | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\aeb31007-f634-4478-9165-7d2909f96118.tmp | — | |
MD5:— | SHA256:— | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp | — | |
MD5:— | SHA256:— | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF3a1d22.TMP | text | |
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30 | SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348 | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:DC32343F45B01764B6267AD36548102A | SHA256:A250F5AD57D4BD58AAE92810D50278E3BE2DBF869F126A3A3519691BCDFC2075 | |||
1504 | WinRAR.exe | C:\Users\admin\Downloads\5de8251f5a294399f426\5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.bin | executable | |
MD5:D2B996951D3F35EB600A6AEFDAB6C327 | SHA256:5DE8251F5A294399F4265C1ABE6296C4800BCF129AEB53B7CD9EA7E4E2098C87 | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:213AE3DA120D7862D60B5763B6C9D466 | SHA256:5736534D6EE654C1BF1A8E79E73330AF58F622E8657285330D2C7189A55604F4 | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
2832 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF3a1d13.TMP | text | |
MD5:DC32343F45B01764B6267AD36548102A | SHA256:A250F5AD57D4BD58AAE92810D50278E3BE2DBF869F126A3A3519691BCDFC2075 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2252 | csrss.exe | GET | 200 | 104.28.28.172:80 | http://mymindmix.ru/ce0fa1041a7deb5dd0dc37a4670c7eea/app/updateprofile-4.exe | US | executable | 2.85 Mb | suspicious |
3964 | chrome.exe | GET | 302 | 172.217.22.46:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 514 b | whitelisted |
3964 | chrome.exe | GET | 302 | 172.217.22.46:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | html | 509 b | whitelisted |
3132 | updateprofile-4.exe | PUT | 201 | 148.251.154.53:80 | http://srv-4.oknazasto.info/pupload/a47d8a5e-1715-4c89-9e2c-dcd6c347c163/chrome?fb= | DE | — | — | unknown |
3964 | chrome.exe | GET | 200 | 74.125.8.155:80 | http://r5---sn-5hnednlr.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=95.211.188.11&mm=28&mn=sn-5hnednlr&ms=nvh&mt=1575645405&mv=u&mvi=4&pl=25&shardbypass=yes | US | crx | 293 Kb | whitelisted |
3964 | chrome.exe | GET | 200 | 209.85.226.10:80 | http://r5---sn-5hnekn76.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=95.211.188.11&mm=28&mn=sn-5hnekn76&ms=nvh&mt=1575645405&mv=u&mvi=4&pl=25&shardbypass=yes | US | crx | 862 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3964 | chrome.exe | 172.217.16.142:443 | apis.google.com | Google Inc. | US | whitelisted |
3964 | chrome.exe | 216.58.207.42:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3964 | chrome.exe | 172.217.21.227:443 | www.google.com.ua | Google Inc. | US | whitelisted |
3964 | chrome.exe | 216.58.208.45:443 | accounts.google.com | Google Inc. | US | whitelisted |
3964 | chrome.exe | 172.217.22.67:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
3964 | chrome.exe | 172.217.23.132:443 | www.google.com | Google Inc. | US | whitelisted |
2648 | 5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.exe | 104.26.15.130:443 | venoxcontrol.com | Cloudflare Inc | US | shared |
3964 | chrome.exe | 172.217.23.99:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3964 | chrome.exe | 172.217.18.110:443 | ogs.google.com | Google Inc. | US | whitelisted |
3964 | chrome.exe | 216.58.207.67:443 | www.google.nl | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com.ua |
| whitelisted |
www.google.com |
| whitelisted |
www.google.nl |
| whitelisted |
venoxcontrol.com |
| unknown |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2648 | 5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.exe | A Network Trojan was detected | ET TROJAN Observed Glupteba CnC Domain (venoxcontrol .com in TLS SNI) |
2252 | csrss.exe | A Network Trojan was detected | ET TROJAN Observed Glupteba CnC Domain (venoxcontrol .com in TLS SNI) |
496 | 5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.exe | A Network Trojan was detected | ET TROJAN Observed Glupteba CnC Domain (venoxcontrol .com in TLS SNI) |
2848 | 5de8251f5a294399f4265c1abe6296c4800bcf129aeb53b7cd9ea7e4e2098c87.exe | A Network Trojan was detected | ET TROJAN Observed Glupteba CnC Domain (venoxcontrol .com in TLS SNI) |
— | — | A Network Trojan was detected | ET TROJAN Glupteba CnC Domain in DNS Lookup |
2252 | csrss.exe | Misc activity | ET USER_AGENTS Go HTTP Client User-Agent |
2252 | csrss.exe | Misc activity | ET INFO Packed Executable Download |
2252 | csrss.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3132 | updateprofile-4.exe | A Network Trojan was detected | ET TROJAN Observed Glupteba CnC Domain (venoxcontrol .com in TLS SNI) |
3132 | updateprofile-4.exe | Misc activity | ET USER_AGENTS Go HTTP Client User-Agent |