glupteba

Target

EB7233922891E1DAD0434FBD52623647.exe
Size

7.9MB
Sample

210818-9p8lqjhwv2
MD5

eb7233922891e1dad0434fbd52623647
SHA1

331126b108532ab9a1e932141bff55a38656bce9
SHA256

b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8
SHA512

597fbb0f397c45c8a2c5f63893c6d6bd4641e952510dfcac05dadb7afaaf4e005df1261649d4e79951979bad0be1fb09feebac7a6d23c31679590cbf40e1d4ac

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  EB7233922891E1DAD0434FBD52623647.exe
- Size
  
  7.9MB
- MD5
  
  eb7233922891e1dad0434fbd52623647
- SHA1
  
  331126b108532ab9a1e932141bff55a38656bce9
- SHA256
  
  b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8
- SHA512
  
  597fbb0f397c45c8a2c5f63893c6d6bd4641e952510dfcac05dadb7afaaf4e005df1261649d4e79951979bad0be1fb09feebac7a6d23c31679590cbf40e1d4ac
Score

10^/10

glupteba metasploit backdoor dropper evasion loader persistence spyware stealer trojan vmprotect
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess
- evasion
  evasion.
  evasion
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- autoit_exe
  AutoIT scripts compiled to PE executables.
behavioral1