Geek's Advice

Glupteba Trojan is filled with criminal features to turn your computer into remotely controlled bot

Glupteba is family name of a powerful Trojan-type malware that includes almost every criminal functionality a computer virus can have. In computer terminology, it is recognized as a bot that turns victim’s computer into a zombie PC that can be controlled by cybercriminals remotely. This malicious software typically spreads via malvertising or EternalBlue exploit and is capable of dropping additional payloads on victim’s computer. Components of this multi-functional malware allow it to work as a rootkit, security software disabler, virus, browser local data stealer, cryptojacker and a router attack tool. Moreover, this malware is capable of hiding its presence on victim’s compyter. If your security software triggered an alert for this Trojan, you should eliminate it immediately.

Trojan.Glupteba is also noticed to be able to switch between Command & Control servers easily as it uses blockchain technology to retrieve updated addresses.

Currently known list of Glupteba Trojan’s functionalities is presented below. The malware is also known to be under continuous development.

• A router attack tool. This component, created with Go programming language, is downloaded by the Trojan dropper as well. This tool looks for a default gateway into victim’s network. The malware attempts to connect to router device and exploit it using CVE-2018-14847 vulnerability. This vulnerability mainly affects RouterOS system on MikroTik routers, allowing the criminals to steal administrator’s credentials from unpatched routers and transfer them to the Command&Control server.
• A rootkit. The malware uses various Windows kernel drivers to hide its files and processes. Although nowadays rarely used, kernel-based rootkits allow cybercriminals to avoid detection by antivirus or anti-malware programs and continue malevolent operations successfully.
• A virus. Glupteba leverages the EternalBlue exploit to self-spread on victim’s network and any other computer it can reach.
• A Browser data stealer. This malware is capable of reaching and stealing essential local data files from popular browsers, including Google Chrome, Mozilla Firefox, Yandex and Opera and uploading them to the C&C server. These files contain essentially private data, such as login details, authentication cookies, browsing history and more.
• A crypto miner. The malware includes two crypto mining tools that dig those cryptocurrencies for criminals at the price of your electricity bill.
• A security software evader. Glupteba virus includes a component that attempts to turn Windows Defender off, with regular checks if it is still disabled. The Trojan also has a list of security software to shut down, to prevent them from flagging the malicious processes and their activity as anomalies.

Beware that this malicious Trojan often hides in various downloads that interest the gaming community – games, add-ons, mods, cracks, extension packs and similar tools. If you suspect that your computer has been infected with this malware, scan with robust anti-malware while in Safe Mode (download the security software while in regular mode and update it from there). If you wish to repair computer system after virus damage, consider scanning with RESTORO.

Name	Glupteba Trojan
Type	Trojan; Complex Malware; Distribution Framework
Functionality	This Trojan includes a wide set of continuously expanding functions, including: a rootkit, virus, crypto miner, AV disabler, data stealer, router attack tool
Detection names	Trojan:Win32/Glupteba!atmn (Microsoft), Trojan.Glupteba (Malwarebytes), ML/PE-A + Troj/Glupteba-M (Sophos)
Associated malware	Known Microsoft detection name for STOP/DJVU malware variants – Trojan:Win32/Glupteba.NW!MTB
Danger	Steals private information, controls computer remotely, uses login data to hack into computer and use it for further distribution or illegal activities, making the victim look as a cybercriminal
Distribution	Hides in illegal torrent downloads, adware bundles, fake ads and other malware
Removal	Remove using powerful anti-virus suite while in Safe Mode. Consider scanning with RESTORO after to repair caused damage to Windows OS files.

Trojan distribution strategies

Glupteba Trojan is infamous for its complex distribution techniques, and of course the variety of them. Moreover, there are various strains of this malware, and each of their distribution differs. In this article, we are going to review the most common and well-known distribution methods used by this Trojan’s operators.

The Trojan was first noticed back in 2011 and was distributed via TDL-4 bootkit (a malware downloader). It is believed that the operators behind TDL-4 were selling malware distribution service for other criminals on the dark web, as the bootkit was used to distribute a variety of malware variants.

In 2014, ESET revealed its investigation of Operation Windigo, which appeared to be associated with Trojan’s distribution. The operators behind this criminal scheme used compromised Linux servers to redirect part of HTTP requests through infectious web server instances. Redirected requests were routed to DNS servers controlled by Operation Windigo operators. The final redirection then would reach targets that hosts exploit kits. If the exploitation succeeded, Glupteba malware was dropped on compromised system.

In March 2018, ESET researchers reported about a change in the Trojan’s distribution. According to them, Windigo is no longer used for the virus’ proliferation, and instead it uses its own botnet. The virus appears to travel alongside deceptive adware (detection name MSIL/Adware.CsdiMonetize.AG) that uses a pay-per-install scheme to promote a variety of malware families, such as cryptocurrency miners, adware, as well as malware droppers that bypass security systems and install Glupteba.

Another distribution scheme reported by Infoblox in 2020 relies on a fake Youtube video download site. After entering a video link and clicking Download, the victim would then be presented with a fake file named after user’s chosen video, yet ending in .exe and prompting that the file isn’t a video, but a plain executive program. If the victim opens the file, this results in a download of additional malware components from a CDN server to expand its capabilities. The rest of the attack chain is similar to the scheme explained earlier.

Remove Glupteba Trojan safely

Although it is hard to remove Glupteba Trojan, you need to do it, the sooner, the better. If you’re positive that your computer is compromised by this malware, it isn’t good news for you. It simply means that your computer now is a bot controlled by a remote cybercriminal, most likely to perform further criminal activities by leveraging your PC’s resources and your electricity bill. That said, we recommend you to download powerful anti-malware or antivirus software that is known to take care of this specific malware. Then, boot in Safe Mode to run your security program and eliminate all of virus’ components.

If you have already performed successful Glupteba virus removal, then start recovering your computer from the attack. Our recommendations include the following:

• Clear browsing cache for all time in your browsers and change all of your passwords for accounts saved in your browser’s memory.
• Contact your bank and inform about possible theft of bank and credit card credentials, and follow their commands for securing your financial funds and privacy.
• Update and patch software and operating system, both on your computer and routers.
• Use antivirus with real-time protection to be informed about malicious files dropped on your computer.
• Avoid visiting insecure websites to never install a similar threat again.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.