Extracted

• • Target

    a0c6d81a0744de68981c50c0549bf59e

  • Size

    4.3MB

  • MD5

    a0c6d81a0744de68981c50c0549bf59e

  • SHA1

    b3da7c9d0c565877662eb53b41288aaa206b28f7

  • SHA256

    eb152515a4bc9554b4ba304dacd4a8428d9d80f1933a24b4577e0081b264bbc5

  • SHA512

    14049eecdc0b5f68ecf2e2a13576616e531803fb75f8a61687557b492087cc6343332fbd32a27b4137ff5f6550d67a6f221294e6ac00b09e7057941280f16857

  • SSDEEP

    98304:3zWlg1FvpkbQe2mFhlZzoAZv47H1g4lR3a3TGeHCzB:3T1F7eXTZv4b1guha36eKB

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencerootkittrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Windows security bypass

    evasiontrojan

  • Modifies boot configuration data using bcdedit

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Manipulates WinMon driver.

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion

  • Drops file in System32 directory

  behavioral1behavioral2