Overview

overview

10

Static

static

1

f50d7e5eb8...18.exe

windows7-x64

10

f50d7e5eb8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f50d7e5eb828c1b64b674b1decf32416_JaffaCakes118

  • Size

    4.4MB

  • Sample

    240417-e9c8fafd91

  • MD5

    f50d7e5eb828c1b64b674b1decf32416

  • SHA1

    1d2dfe56e6693572cebc72ce617a03070798c7a3

  • SHA256

    be33ed4f9d804207cde82fe2402766243c4739a2c4d9319cf4781858eca82e07

  • SHA512

    269bae52d7877fa4a138cb3106402a5d7cff2132e8448b559c40ee1515ff88b548ea37a22e59da29c790f20a22e64fa22993d35a6788b85507808cd8c7653eab

  • SSDEEP

    98304:iQRi8rzyu4absB48jEzr5ufxD7k4eArxz3JAq6B:iQRiiKabU4YEzFux04fxWlB

Score
10/10
gluptebametasploitbackdoordropperevasionloadertrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      f50d7e5eb828c1b64b674b1decf32416_JaffaCakes118

    • Size

      4.4MB

    • MD5

      f50d7e5eb828c1b64b674b1decf32416

    • SHA1

      1d2dfe56e6693572cebc72ce617a03070798c7a3

    • SHA256

      be33ed4f9d804207cde82fe2402766243c4739a2c4d9319cf4781858eca82e07

    • SHA512

      269bae52d7877fa4a138cb3106402a5d7cff2132e8448b559c40ee1515ff88b548ea37a22e59da29c790f20a22e64fa22993d35a6788b85507808cd8c7653eab

    • SSDEEP

      98304:iQRi8rzyu4absB48jEzr5ufxD7k4eArxz3JAq6B:iQRiiKabU4YEzFux04fxWlB

    Score
    10/10
    gluptebametasploitbackdoordropperevasionloadertrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Firewall

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks