glupteba

General

Target

3ceac9d8f1234321d9c814095000dde6f3e13a4c93529742dfbaa88e237f1c7f
Size

4.4MB
Sample

220703-fhmhgafger
MD5

c351940469547f3a1db55e6ff9bad043
SHA1

4c4728a116cff1e26426945a0d5d4bef2780354e
SHA256

3ceac9d8f1234321d9c814095000dde6f3e13a4c93529742dfbaa88e237f1c7f
SHA512

ab38a3e4e1bab29d7ebe195bc688c16d1ee60f29074dd73dd9f88a2ad6bcbf1662491e4b105a5be5e41e88dcbe4cc2f0aaa20bd613d7c43cbe1bc0bb78074887

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  3ceac9d8f1234321d9c814095000dde6f3e13a4c93529742dfbaa88e237f1c7f
- Size
  
  4.4MB
- MD5
  
  c351940469547f3a1db55e6ff9bad043
- SHA1
  
  4c4728a116cff1e26426945a0d5d4bef2780354e
- SHA256
  
  3ceac9d8f1234321d9c814095000dde6f3e13a4c93529742dfbaa88e237f1c7f
- SHA512
  
  ab38a3e4e1bab29d7ebe195bc688c16d1ee60f29074dd73dd9f88a2ad6bcbf1662491e4b105a5be5e41e88dcbe4cc2f0aaa20bd613d7c43cbe1bc0bb78074887
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2