Extracted

• • Target
    7d5d5c3a22d16d1537581ff7887ef4e0N
  • Size 4.4MB
  • SHA256 4aa03edec78c1235510cf80b72b1806c0c2273bf3ae6c2d1b6c49279caed99cb
  • MD5 7d5d5c3a22d16d1537581ff7887ef4e0
  • SHA1 13989fc5a90406cf2d6cfa94f5acae8857404ade
  • SHA512 43f36e6c39443723596a29084aa86b2856cb5d4cd4346ca8c31f79bfbf9bb054236676233e823789133a1e031023f4e283229e4ce8f4de70a3198b4d9b94aa35
  • SSDEEP 98304:JsVNWL4Q4V7b4+6c5I2RCERmkjB4pcMXg8Shaglvn40ir/7Dwid9:4NWL4QOQMHDRmkjGMDhagv40irHw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistenceprivilege_escalationrootkittrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Windows security bypass

    evasiontrojan

  • Modifies boot configuration data using bcdedit

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Manipulates WinMon driver.

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  behavioral1behavioral2