Extracted

Extracted

• • Target

    c4a2e403dc091a191ae09578bf914baf70fd9b2d9593f8061dc953cbd431e5b5

  • Size

    12.5MB

  • MD5

    18055926fc6bebb1f519fe3188473565

  • SHA1

    4b35d30c0b45f050610c8032f7f2ead68cf32aee

  • SHA256

    c4a2e403dc091a191ae09578bf914baf70fd9b2d9593f8061dc953cbd431e5b5

  • SHA512

    3e36e518300727420883c6a5c425fb381a760a3d559c2440d081a48f178a2c13255b3061898fb4b46611bac946ec57b22895c205fff7ce03076cfb6d63783545

  • SSDEEP

    196608:VXJJnYZkz7SKwTEu/qEIshS35kTuB4c6IT2laHaDs4GHEx2z1P+3vXSTlWCFJx:VX00GKwTVqg43OFyaHgS2xQ/STX

  Score

  10^/10

  gluptebasmokeloaderup3backdoordiscoverydropperevasionloaderpersistencetrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2