Extracted

Extracted

Extracted

• • Target

    772a2f758d727013aef9c9d9f5861394dae7fd20a937bc2cbc4dabdc0d94a55e

  • Size

    534KB

  • MD5

    cd68a3823da02633a2aef5a0824abfd5

  • SHA1

    139817ced7d45f0b32444eee7833c8e2c00a6b96

  • SHA256

    772a2f758d727013aef9c9d9f5861394dae7fd20a937bc2cbc4dabdc0d94a55e

  • SHA512

    ea9ddf2f6104df3d90339f74e00eb465854f9cdcab9634816fa6578d6a61be70d96cb6aee3c9c890a3c70baf7f8b87c31eeef9fbabfb0737968b61092b347c3b

  • SSDEEP

    6144:f+AUxvdjNgBoHFIZ0YesFZITJuUQnBhC/ya6H9fV:zQNg2FTJuUQnnV

  Score

  10^/10

  gluptebasmokeloaderxmrigup3backdoorgooglediscoverydropperloaderminerphishingtrojan

  • Detected google phishing page

    phishinggoogle

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1