Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    d0f3fda9bfe96872981a8de4ef913856.exe
  • Size 287KB
  • SHA256 a7b430e703fe6d3cdebfd2924e992abf89a959fee3afe83d91a68c87f7783eef
  • MD5 d0f3fda9bfe96872981a8de4ef913856
  • SHA1 d41a417994e15fa010cfb252d25e7ffbfe88bc39
  • SHA512 461121c77953447cf75fcb71d25d0ce7306c4b09e4db0d2c5aecb1d74105fa76f14864b0d012e7969e1f5e3a343ce7c8c2d9d0f37172030daf072e7f1013f080
  • SSDEEP 3072:6ziRfFi3WzI2OHDbNMCicIQ1yEqkAhDexm0sCfCPvlZg2J5aLwutfUxaIa2VM:DRfFD6OCxFyEqkjxm0sCuZJJ5OUxaIh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gluptebasmokeloaderstealcpub1backdoorbootkitdropperevasionloaderpersistencestealertrojanupxlumma

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies boot configuration data using bcdedit

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Stops running service(s)

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2