glupteba

General

Target

1105c6506d94d440e44ce637e0e7d87c7aed386cf99d870f9bea04e3655614bf
Size

3.9MB
Sample

220604-mc6gqafdck
MD5

fb5106b00132654be98257e2ba38a950
SHA1

f462763f1c9881eb97c085382ffd4674d304c8d2
SHA256

1105c6506d94d440e44ce637e0e7d87c7aed386cf99d870f9bea04e3655614bf
SHA512

81038ec7ba4c9c4661625c16ceb3ce425b2afea09c47f7c1d46050be8c94022f5e81af6b9b5accf483d7ab1f2fa60e6eeae8883cac945fde68ff5ecab7069863

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  1105c6506d94d440e44ce637e0e7d87c7aed386cf99d870f9bea04e3655614bf
- Size
  
  3.9MB
- MD5
  
  fb5106b00132654be98257e2ba38a950
- SHA1
  
  f462763f1c9881eb97c085382ffd4674d304c8d2
- SHA256
  
  1105c6506d94d440e44ce637e0e7d87c7aed386cf99d870f9bea04e3655614bf
- SHA512
  
  81038ec7ba4c9c4661625c16ceb3ce425b2afea09c47f7c1d46050be8c94022f5e81af6b9b5accf483d7ab1f2fa60e6eeae8883cac945fde68ff5ecab7069863
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2