glupteba

General

Target

54450f27c3e1c4a2dcfd5010a3670b7e5bc9573c8d6acc40d68512964e4f57be
Size

4.3MB
Sample

220725-yjpckacdh5
MD5

61a74e99ff2fb974618ea835ec07f89c
SHA1

330b1a372f3557c33ac38c71ca370340f491a94d
SHA256

54450f27c3e1c4a2dcfd5010a3670b7e5bc9573c8d6acc40d68512964e4f57be
SHA512

13ae2631b47019d4917aa176f899f6f25e4d4ccb363fe81b1afa1de7ef6a196980252687e15c1abc751b29d2001b5ce32b6c748298d0b1dcd4018292abcb0172

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  54450f27c3e1c4a2dcfd5010a3670b7e5bc9573c8d6acc40d68512964e4f57be
- Size
  
  4.3MB
- MD5
  
  61a74e99ff2fb974618ea835ec07f89c
- SHA1
  
  330b1a372f3557c33ac38c71ca370340f491a94d
- SHA256
  
  54450f27c3e1c4a2dcfd5010a3670b7e5bc9573c8d6acc40d68512964e4f57be
- SHA512
  
  13ae2631b47019d4917aa176f899f6f25e4d4ccb363fe81b1afa1de7ef6a196980252687e15c1abc751b29d2001b5ce32b6c748298d0b1dcd4018292abcb0172
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2