glupteba

General

Target

615fd9103ed76f3699391abb2cf06d6267dab9453ac662e254202c35dbc53a79
Size

4.5MB
Sample

220730-z8eebshffr
MD5

8ca8725188de3e4a4cb3e5005bb02d23
SHA1

526ce583978781a451a3f6a1991f1f1258c05a9c
SHA256

615fd9103ed76f3699391abb2cf06d6267dab9453ac662e254202c35dbc53a79
SHA512

14ee6bd8e4e54f485f9be9c86c912bb2c8bc937483306021fc5d7373aefb5c741620b1ed8ae001686d81018aba224fab63f2183792efa6a59de2dd8562a0e84b

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  615fd9103ed76f3699391abb2cf06d6267dab9453ac662e254202c35dbc53a79
- Size
  
  4.5MB
- MD5
  
  8ca8725188de3e4a4cb3e5005bb02d23
- SHA1
  
  526ce583978781a451a3f6a1991f1f1258c05a9c
- SHA256
  
  615fd9103ed76f3699391abb2cf06d6267dab9453ac662e254202c35dbc53a79
- SHA512
  
  14ee6bd8e4e54f485f9be9c86c912bb2c8bc937483306021fc5d7373aefb5c741620b1ed8ae001686d81018aba224fab63f2183792efa6a59de2dd8562a0e84b
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2