Extracted

• • Target

    36dc15aa6901f38cd68678b2c45459bb82d9cb7965dd36a63315eab2f907130c

  • Size

    4.4MB

  • MD5

    ca238d5c3cad35c97523fb5be080c6a3

  • SHA1

    431830885ee07ff89943a8e85cc14fb8c6ffdd04

  • SHA256

    36dc15aa6901f38cd68678b2c45459bb82d9cb7965dd36a63315eab2f907130c

  • SHA512

    971bd77541ce675bd8f3f61720dda8a5f5be71b8b90cd07bd46723f2fa71c22ee30bd07f55e11a2d83e87a0071182be8ccba6178c9cb3a9f6d45eace371693d5

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencetrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2