glupteba

General

Target

4c5efdc9313c9fc6815288922ac6c5ab039088ece3e00832948f46c983570072
Size

3.8MB
Sample

220712-g7j93segdk
MD5

865102f865aee65ef616330fc6dbdd53
SHA1

065102e3383ebea037d6d239475360a96d10d215
SHA256

4c5efdc9313c9fc6815288922ac6c5ab039088ece3e00832948f46c983570072
SHA512

429864e9d8a737f07115188e0c639e3ebb182a906307945b992a8337ae682952795c9cc9dd74a9a2012124bcf440cbafa074ab2a7d35acb834dfd23f4a8a20cc

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  4c5efdc9313c9fc6815288922ac6c5ab039088ece3e00832948f46c983570072
- Size
  
  3.8MB
- MD5
  
  865102f865aee65ef616330fc6dbdd53
- SHA1
  
  065102e3383ebea037d6d239475360a96d10d215
- SHA256
  
  4c5efdc9313c9fc6815288922ac6c5ab039088ece3e00832948f46c983570072
- SHA512
  
  429864e9d8a737f07115188e0c639e3ebb182a906307945b992a8337ae682952795c9cc9dd74a9a2012124bcf440cbafa074ab2a7d35acb834dfd23f4a8a20cc
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2