Extracted

Extracted

• • Target

    f9bc3ddfb1e5e253dac94c91d2d678ad2f1c61537207e71fc04d42af28b04520

  • Size

    15.1MB

  • MD5

    559ca2307ada0f6652973f8154e17245

  • SHA1

    01f7855425d14d3db3d66963b7ae68ca1a9f05e6

  • SHA256

    f9bc3ddfb1e5e253dac94c91d2d678ad2f1c61537207e71fc04d42af28b04520

  • SHA512

    3e1b0a2cdaa34ef98c8b19f95dff57df03ab02a77265319eba8ff6e472c836c576ce2b604f73d678d4a5469af24c5f8fdebf181447c23dc054da12de91495c34

  • SSDEEP

    196608:TuGhQczMgBJZ0Jy+neXUjzhmH/hW9vYdlBrm3x4IjreA:TuG+rGXUxU5NZrma0

  Score

  10^/10

  gluptebasmokeloaderup3backdoordiscoverydropperevasionloaderpersistencerootkitspywaretrojanupx

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1