glupteba | d764def61918e78062c98c3cea0df005a36fb39822d6afe16eb6e229787b27dc | Triage

Submit
Reports

Overview

overview

Static

static

ry76fk1vK4j7.exe

windows7_x64

ry76fk1vK4j7.exe

windows10_x64

Sharing

General

Target

ry76fk1vK4j7.exe
Size

13KB
Sample

210410-hltqw38szj
MD5

5016627be32cf7df19173f67713f7796
SHA1

18216f86c4f2444e8ba398c776f6d80d7054e9ac
SHA256

d764def61918e78062c98c3cea0df005a36fb39822d6afe16eb6e229787b27dc
SHA512

8a7d065000f5982cef373b3965e99ba9d431ffcd87709c419d48d0ec7048ff004301646095330664ff87215793d7ba4672856817da5d16c1f891af7cb5d7a025

Score

10^/10

glupteba metasploit smokeloader backdoor dropper loader persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

ry76fk1vK4j7.exe

Resource

win7v20201028

smokeloader backdoor persistence trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

ry76fk1vK4j7.exe

Resource

win10v20210410

glupteba metasploit smokeloader backdoor dropper loader persistence trojan upx

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

http://999080321test61-service10020125999080321.website/

http://999080321test51-service10020125999080321.xyz/

http://999080321test41-service100201pro25999080321.ru/

http://999080321yest31-service100201rus25999080321.ru/

http://999080321rest21-service10020125999080321.eu/

http://999080321test11-service10020125999080321.press/

http://999080321newfolder4561-service10020125999080321.ru/

http://999080321rustest213-service10020125999080321.ru/

http://999080321test281-service10020125999080321.ru/

http://999080321test261-service10020125999080321.space/

http://999080321yomtest251-service10020125999080321.ru/

http://999080321yirtest231-service10020125999080321.ru/

http://perseus007.xyz/upload/

http://lambos1.xyz/upload/

http://cipluks.com/upload/

http://ragnar77.com/upload/

http://aslauk.com/upload/

http://qunersoo.xyz/upload /

http://hostunes.info/upload/

http://leonisdas.xyz/upload/

rc4.i32

rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  ry76fk1vK4j7.exe
- Size
  
  13KB
- MD5
  
  5016627be32cf7df19173f67713f7796
- SHA1
  
  18216f86c4f2444e8ba398c776f6d80d7054e9ac
- SHA256
  
  d764def61918e78062c98c3cea0df005a36fb39822d6afe16eb6e229787b27dc
- SHA512
  
  8a7d065000f5982cef373b3965e99ba9d431ffcd87709c419d48d0ec7048ff004301646095330664ff87215793d7ba4672856817da5d16c1f891af7cb5d7a025
Score

10^/10

smokeloader backdoor persistence trojan glupteba metasploit dropper loader upx
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

Credential Access

Discovery

System Information Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojan

behavioral2

gluptebametasploitsmokeloaderbackdoordropperloaderpersistencetrojanupx

© 2018-2024

Terms | Privacy