Extracted

• • Target

    bfe8983a980b698c913506e900e64be3

  • Size

    4.4MB

  • MD5

    bfe8983a980b698c913506e900e64be3

  • SHA1

    15054be3ec99e883aa57cb532dc4064aeba9bb9d

  • SHA256

    578db1b685276de5f780c9c5c0b40cc00209e1dd9be9fb4c83f7e2b4cb5610ae

  • SHA512

    34ca2a4c3a763c84c22e551d951dbdcdf0530f03a6c1138dc7bcb287d99c48d303afd001550732d4d25556be9e5c3e315ffd722af99cc49fc5c8f3bf127a924b

  • SSDEEP

    98304:W4k4uKmwYOjbaFBfnLleT0Rnt3S9L2/4NAzWQtEx/rh8ATEYgiHY:64uYYOKDleT0RhS9L+PWMMDQkY

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistencetrojanrootkit

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Windows security bypass

    evasiontrojan

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion

  • Drops file in System32 directory

  behavioral1behavioral2