Extracted

Extracted

Extracted

Extracted

• • Target
    5212ecaf2c3880d92f371356d84105be.exe
  • Size 254KB
  • SHA256 cc4cb393dfc2c8fef2d76f297554a93cbec91244fe7ad5dc3ab533018d52fc84
  • MD5 5212ecaf2c3880d92f371356d84105be
  • SHA1 d17cc3b0083fef207a84eefbb927ac9a79ef01ae
  • SHA512 a1987d88d57e2a835f81b771da0bd8f8d26800d023d088558a688979bd876a8f142fdfe2b2462907be6401152fc3ec7dd87bae0749e118c9ca82080963253a09
  • SSDEEP 3072:Gl6mR5pZ1bjBUEzlFJYPBWk8XMF5uaaaETz:+XpZRj2yY5p4RaavT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gluptebasmokeloaderstealcbackdoorbootkitdropperevasionloaderpersistencestealertrojanupxlummapub1

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2