Extracted

• • Target

    csrss.exe

  • Size

    4.5MB

  • MD5

    2f29ebdaf7b3395ebdadb13f453177c7

  • SHA1

    20913d2d3c145adf43af7f13108cd1eb974862ca

  • SHA256

    5d856f4c0a6a3d6a13cc4b0786328e49511923b3ca208d93010c8e6b122bc708

  • SHA512

    27c258f7f4f9add24666daadf62008bff00f224723623b0463a9d455254cfcbbbcda92488530dcb41a3fad0d688c15630e0d8eda3c6fce031db1a91fc9e03ce7

  • SSDEEP

    98304:477X24Nev1+NrGJ4FSBiD+Fon/wpCmreluztZi3:kX243NrGk+F+/wYmt

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencetrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies boot configuration data using bcdedit

  • Blocklisted process makes network request

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Stops running service(s)

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2