glupteba | 5f9c7df75c9a1dd3d35653d404d346acbceb5d588479daeaee5ba37ee92e0dfd

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20-07-2024 22:16

Target

app.exe
Size

4.4MB
MD5

a6a6273d29cecf465de73ee6d11861c2
SHA1

d3eccd9bb6c17698e726ded7b9f9893a51c5424f
SHA256

5f9c7df75c9a1dd3d35653d404d346acbceb5d588479daeaee5ba37ee92e0dfd
SHA512

f20e942a7f64bcba37a84ee9210f5f9b484b60a6077791c38fb0e0b984d51570a887cdc96d18aeb2503469e767d6e31b4eb32676f07b016aed5af06f88a097c1
SSDEEP

49152:9qxYJWuwdHTjE3czWc6SG+IG/k8i4RjCrnrQJVq9BFAFvHbRC+VFHyY0Cer4TXVX:9KYwJH3nzWvSTIY7jCrj6jbHyYXk9yz

Score

10^/10

Family

metasploit

Version

windows/single_exec

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral4/memory/2300-2-0x0000000005280000-0x0000000005B8B000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2300	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\app.exe
"C:\Users\Admin\AppData\Local\Temp\app.exe"
1⤵
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 276
  2⤵
  - Program crash
  PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2300 -ip 2300
1⤵
PID:408

memory/2300-1-0x0000000004E40000-0x000000000527C000-memory.dmp

Filesize
4.2MB

Download
memory/2300-2-0x0000000005280000-0x0000000005B8B000-memory.dmp

Filesize
9.0MB

Download