glupteba

General

Target

48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e
Size

3.9MB
Sample

220714-cgppnabge7
MD5

6cdb82a5248095408ead1969b1c30f4b
SHA1

6414d0f3dc303c834f0ddce218139348074bbdac
SHA256

48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e
SHA512

c733680634d575fee025768842f769e9409e6e90a4d05a2eea572b489107448ab87f86205f742e66cc95acb78093b26b0cbcc1e1021ec325d82535213f39401a

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e
- Size
  
  3.9MB
- MD5
  
  6cdb82a5248095408ead1969b1c30f4b
- SHA1
  
  6414d0f3dc303c834f0ddce218139348074bbdac
- SHA256
  
  48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e
- SHA512
  
  c733680634d575fee025768842f769e9409e6e90a4d05a2eea572b489107448ab87f86205f742e66cc95acb78093b26b0cbcc1e1021ec325d82535213f39401a
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2