Extracted

Extracted

• • Target
    file.exe
  • Size 306KB
  • SHA256 96ef0fa612962e229cabe7c23fcd099a34fc49e3dc760aafbddc6c44358db341
  • MD5 582200a724af12a4a525bf2ae4d8b75b
  • SHA1 a7dba48a45fa92a8649e7eb26d9b571ee1080644
  • SHA512 280e6a29bfb7eb6fc753af60add534d01f97ccbfc82895419f21068c1c8c6b9c3ea12eb9280c27284c1210f7f246fae2409868ea1c4662ce6901c15943a47491
  • SSDEEP 6144:bt5/EuhHWN6cANbJr0T/gkfGCUKv/mXGGpYj3:p5suhHWN6cobZY/gkf0XG4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gluptebasmokeloaderpub1backdoorbootkitdropperevasionloaderpersistencetrojanupxdiscovery

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2