Extracted

Extracted

Extracted

• • Target
    8f7bc78b3013bcf433841e4abb1b5565.exe
  • Size 328KB
  • SHA256 cc3da71857b8b0e55de25cccaa43b3d521866c6f82e29008d7a55b8ed8ef8168
  • MD5 8f7bc78b3013bcf433841e4abb1b5565
  • SHA1 46cf2c80661737dcb7477ed606b8766fcbeabb9a
  • SHA512 1027491d06817c8fb9b073aef59bdee1e12bceec36e21b581cf21e19a0ebb11204a3601dcf68ae4e47214b71f1173dc8ff6d1a87d12f915552e199979d3c058d
  • SSDEEP 6144:6pluEruJjFzQsXxuRWB0gHgVtgRohURFfnLttb+T7:iIEruJjFvhLZgVtgqifLDbm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gluptebasmokeloadersocks5systemzstealcpub1backdoorbootkitbotnetdropperevasionloaderpersistencestealertrojanupx

  • Detect Socks5Systemz Payload

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies boot configuration data using bcdedit

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2