Extracted

Extracted

• • Target

    3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50

  • Size

    13.3MB

  • MD5

    5b93c5a39aa96f661dc53b4eda00e3fb

  • SHA1

    ccc61ea8e58ed309c96ae19a3cdda3973168e128

  • SHA256

    3481e519a886d3970e852d0513034efd0c9d71481b70533ca3c6b92ec83c1d50

  • SHA512

    bb3b30bf62be5c3ab8c8fa041c503a888c47b33c7db11443459c85f6f6ac70eb3d3cff1faccc18b092fdcde5b44b937dfa08e9aaf7de57c3da31c4fc57437523

  • SSDEEP

    196608:YJ53FaC5MGewrlcf7qE4C11FO4Pt651rdH1cfdSp3+JHmeNFSutuomP+3B:YJ5wWDewrGefCAKw5efdM3+EepupP8

  Score

  10^/10

  gluptebasmokeloaderstealcup3backdoordiscoverydropperevasionloaderpersistencerootkitspywarestealertrojanupx

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1