Extracted

• • Target

    4d0245f0e331de1aa6df6eb9b8aee6bc

  • Size

    4.4MB

  • MD5

    4d0245f0e331de1aa6df6eb9b8aee6bc

  • SHA1

    9aa1e6dbe5d1b588efc767384a35ebb5ccc60c8e

  • SHA256

    88617eed3ffeb661769ad27b1d9c3de31d8dad24d68ea8a7c20645b6fdb6f380

  • SHA512

    548f42533ccdafd58a32f0cbe1fd40e90079f57cd69052d40b780c1fb00acf13e6cb6038ed8b92a83fd60842b0ed9fab20ab6d9717a746f893601d797fcfadbc

  • SSDEEP

    98304:3HQVtpwyWFAYcP6PhdmeJbdT4e/2o1FBCrBjc29AQr0v:gNJQAapJJMm149Uv

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencetrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Windows security bypass

    evasiontrojan

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2