Extracted

Extracted

Extracted

• • Target

    aa234447899c8ce342f8b90ddd3bc2ba20cb51ed6856835ba9c18e842f057215

  • Size

    4.8MB

  • MD5

    bf088df8bb2bd9bdd4effd6c60ae1209

  • SHA1

    dde5e839b66793bddc51a96840a4562ac0783912

  • SHA256

    aa234447899c8ce342f8b90ddd3bc2ba20cb51ed6856835ba9c18e842f057215

  • SHA512

    91b5604f7e5c16e9000295c3de9ee5e04cb9ba2260e2dd2014a34c5d92d2ed1a45dfd733e4775e6e26cbeebc6d648eb31010cff1dc8e358b34fa0d6c2b2053a9

  • SSDEEP

    98304:lAenKZbSYG/aC+Gb1F6Notrwm5W46tUosy1S0BXwA:OWK0hX3ZFbGmF6ky1nX

  Score

  10^/10

  gluptebasmokeloaderpub5up3backdoordropperevasionloaderpersistencerootkittrojanupx

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1