Extracted

• • Target

    398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5

  • Size

    4.3MB

  • MD5

    23e940efe55576aeea02f54992c58d09

  • SHA1

    7620ba8933e3cf83e757ae042f2adfb980174c8e

  • SHA256

    398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5

  • SHA512

    4b8c70dfc87a7d0f429ef6bd21ec669d30cedd02e701b19e094afb4c6d913a2d2a71ba6adc41e702cec219814d00a981ae5e33447be055878a2ff4c99a769ae3

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencetrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2