Extracted

• • Target

    5d856f4c0a6a3d6a13cc4b0786328e49511923b3ca208d93010c8e6b122bc708

  • Size

    4.5MB

  • MD5

    2f29ebdaf7b3395ebdadb13f453177c7

  • SHA1

    20913d2d3c145adf43af7f13108cd1eb974862ca

  • SHA256

    5d856f4c0a6a3d6a13cc4b0786328e49511923b3ca208d93010c8e6b122bc708

  • SHA512

    27c258f7f4f9add24666daadf62008bff00f224723623b0463a9d455254cfcbbbcda92488530dcb41a3fad0d688c15630e0d8eda3c6fce031db1a91fc9e03ce7

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencetrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2