Extracted

• • Target

    752792ea15719843ad02dd934ca1ca5a_JaffaCakes118

  • Size

    4.4MB

  • MD5

    752792ea15719843ad02dd934ca1ca5a

  • SHA1

    9c1f88bda900c9fd0f8ffd4baceb69fa9c8bad30

  • SHA256

    be6bc6e73f1477d4bd173f131d51d6059bae1740dbed79f3d63688f4af0784b1

  • SHA512

    d64b4d9333b6356a02ba322b6c322fd86eb642015d445077a2b5baa89d5ca2badd1b4735e5d53620c80482b583a0d9a51592b18aec37d7bebb9cc186291c444b

  • SSDEEP

    98304:NrquT4lOUDEatPU9xUL/PX7jpvsz64qUopE1gxGKORnhFOYW:NrvElOkvUon/azHqzpE1gQKOi

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistenceprivilege_escalationrootkittrojan

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Windows security bypass

    evasiontrojan

  • Modifies boot configuration data using bcdedit

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Manipulates WinMon driver.

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  behavioral1behavioral2