glupteba | 5c37c01349f7a08af9abe32e50cb70bcb9487063f1f1db2e9198600b699211ef | Triage

Submit
Reports

Overview

overview

Static

static

zhhrnz1iPtu7.exe

windows7_x64

zhhrnz1iPtu7.exe

windows10_x64

Sharing

General

Target

zhhrnz1iPtu7.exe
Size

13KB
Sample

210410-sjpln9b3ce
MD5

1f3269137c01af5e37500c7b30d057ae
SHA1

ab2fc7273501d6507c3e45dcd7895c70ad7a82c7
SHA256

5c37c01349f7a08af9abe32e50cb70bcb9487063f1f1db2e9198600b699211ef
SHA512

c542b9b0bec0d22b2027b44806e015ba6561ce4949244444718e6c24395b49ec60f20400764645ddccc9add596cc1567cd615f5eaed34f3b82eb6cc7ed7a66bc

Score

10^/10

glupteba metasploit smokeloader backdoor dropper loader persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

zhhrnz1iPtu7.exe

Resource

win7v20201028

smokeloader backdoor persistence trojan upx

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

zhhrnz1iPtu7.exe

Resource

win10v20201028

glupteba metasploit smokeloader backdoor dropper loader persistence trojan upx

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

http://999080321test61-service10020125999080321.website/

http://999080321test51-service10020125999080321.xyz/

http://999080321test41-service100201pro25999080321.ru/

http://999080321yest31-service100201rus25999080321.ru/

http://999080321rest21-service10020125999080321.eu/

http://999080321test11-service10020125999080321.press/

http://999080321newfolder4561-service10020125999080321.ru/

http://999080321rustest213-service10020125999080321.ru/

http://999080321test281-service10020125999080321.ru/

http://999080321test261-service10020125999080321.space/

http://999080321yomtest251-service10020125999080321.ru/

http://999080321yirtest231-service10020125999080321.ru/

http://perseus007.xyz/upload/

http://lambos1.xyz/upload/

http://cipluks.com/upload/

http://ragnar77.com/upload/

http://aslauk.com/upload/

http://qunersoo.xyz/upload /

http://hostunes.info/upload/

http://leonisdas.xyz/upload/

rc4.i32

rc4.i32

rc4.i32

rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  zhhrnz1iPtu7.exe
- Size
  
  13KB
- MD5
  
  1f3269137c01af5e37500c7b30d057ae
- SHA1
  
  ab2fc7273501d6507c3e45dcd7895c70ad7a82c7
- SHA256
  
  5c37c01349f7a08af9abe32e50cb70bcb9487063f1f1db2e9198600b699211ef
- SHA512
  
  c542b9b0bec0d22b2027b44806e015ba6561ce4949244444718e6c24395b49ec60f20400764645ddccc9add596cc1567cd615f5eaed34f3b82eb6cc7ed7a66bc
Score

10^/10

smokeloader backdoor persistence trojan upx glupteba metasploit dropper loader
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

Credential Access

Discovery

System Information Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

smokeloaderbackdoorpersistencetrojanupx

behavioral2

gluptebametasploitsmokeloaderbackdoordropperloaderpersistencetrojanupx

© 2018-2024

Terms | Privacy