glupteba | 7b8a8c6b1b0bf9d637c94f73d189f81398837eaa1d9cd431eeff6e7a398a32b4 | Triage

Submit
Reports

Overview

overview

Static

static

1

f67ac68040...18.exe

windows7-x64

f67ac68040...18.exe

windows10-2004-x64

Sharing

General

Target

f67ac68040dcf6a7c499bbc0d149397d_JaffaCakes118
Size

4.4MB
Sample

240417-xxtzjabd37
MD5

f67ac68040dcf6a7c499bbc0d149397d
SHA1

4e61f7ca82126d8aab52a1881965d1ed38f93769
SHA256

7b8a8c6b1b0bf9d637c94f73d189f81398837eaa1d9cd431eeff6e7a398a32b4
SHA512

4398c085593c7756257dd3eaf859b5e16a393280d2bd2601902c3e44453ad77748a32c95ee9c5ceaf998ebb4b23ab3a9d235351865d2ffe33387657102b61719
SSDEEP

98304:/MnpKSZysIUJDO7lTEWp+E/zFCDzq4RMZXNxstXfuBGtbGERHpc8tac:kgOyxotW8MzFCyNef/EERHp3tac

Score

10^/10

glupteba metasploit backdoor dropper evasion loader ransomware trojan

Static task

static1

Behavioral task

behavioral1

Sample

f67ac68040dcf6a7c499bbc0d149397d_JaffaCakes118.exe

Resource

win7-20240220-en

glupteba metasploit backdoor dropper evasion loader ransomware trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

f67ac68040dcf6a7c499bbc0d149397d_JaffaCakes118.exe

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  f67ac68040dcf6a7c499bbc0d149397d_JaffaCakes118
- Size
  
  4.4MB
- MD5
  
  f67ac68040dcf6a7c499bbc0d149397d
- SHA1
  
  4e61f7ca82126d8aab52a1881965d1ed38f93769
- SHA256
  
  7b8a8c6b1b0bf9d637c94f73d189f81398837eaa1d9cd431eeff6e7a398a32b4
- SHA512
  
  4398c085593c7756257dd3eaf859b5e16a393280d2bd2601902c3e44453ad77748a32c95ee9c5ceaf998ebb4b23ab3a9d235351865d2ffe33387657102b61719
- SSDEEP
  
  98304:/MnpKSZysIUJDO7lTEWp+E/zFCDzq4RMZXNxstXfuBGtbGERHpc8tac:kgOyxotW8MzFCyNef/EERHp3tac
Score

10^/10

glupteba metasploit backdoor dropper evasion loader ransomware trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

gluptebametasploitbackdoordropperevasionloaderransomwaretrojan

behavioral2

© 2018-2024

Terms | Privacy