glupteba

General

Target

41d694e43be9e3ebbe67b107a261f0e024e051c44df14b5d6fee61f8c7dad2d9
Size

4.3MB
Sample

220708-e3p9esbeb7
MD5

0c6226d4f64d300596c06d153486ecea
SHA1

34c60db1012c24aff685e9ac9c25c925c4236f08
SHA256

41d694e43be9e3ebbe67b107a261f0e024e051c44df14b5d6fee61f8c7dad2d9
SHA512

cf8f8cbba886833cc73ffe23bef72a59a32d4a7549e14dad24af75746364f6485642844eb3c32d704525df0cfb5dcfd92fd43c89b240307bceca244be6a9d91b

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  41d694e43be9e3ebbe67b107a261f0e024e051c44df14b5d6fee61f8c7dad2d9
- Size
  
  4.3MB
- MD5
  
  0c6226d4f64d300596c06d153486ecea
- SHA1
  
  34c60db1012c24aff685e9ac9c25c925c4236f08
- SHA256
  
  41d694e43be9e3ebbe67b107a261f0e024e051c44df14b5d6fee61f8c7dad2d9
- SHA512
  
  cf8f8cbba886833cc73ffe23bef72a59a32d4a7549e14dad24af75746364f6485642844eb3c32d704525df0cfb5dcfd92fd43c89b240307bceca244be6a9d91b
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2