Extracted

• • Target

    52d0c0243386eb7c8c507153ec9788bb53264b6ee30bc16962f3c3fcc4b0cff3

  • Size

    4.3MB

  • MD5

    1b2ad09fbe6a284aa2114f598b77aefd

  • SHA1

    30016ba58872d05983b45d4f81d81a1b60af7ac7

  • SHA256

    52d0c0243386eb7c8c507153ec9788bb53264b6ee30bc16962f3c3fcc4b0cff3

  • SHA512

    bc747ae211af38b1d2921d6c2fc5aa49174abf25896be19a12f58ada48a607198548487073eb98683fe1b125080774527411e217f32d020bf59c8607f19383c0

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencetrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2