Extracted

• • Target

    JaffaCakes118_630cd4d358fefb00c803d30c12d5cb2f30dabde0316c5245f5ec0d58652026e8

  • Size

    4.4MB

  • MD5

    45f91ffa762c4f538e40f5fafa156334

  • SHA1

    78e228b986fc746cbedf47ccc7d0f0ace8847025

  • SHA256

    630cd4d358fefb00c803d30c12d5cb2f30dabde0316c5245f5ec0d58652026e8

  • SHA512

    a08f5235823e7c2bde7ec404bc5111748981f9f9c5f5d7a44661c180fa6c1b77171e3cfed58e1274adcc364ee7e519d12cadd32008749af0d19d112618d82ac1

  • SSDEEP

    98304:mTpXhEkwtC1gGsw5da71jFPAg/QoHPOyqKJVBOV2YomVAuT5qs8O:MXhEkwoGNjjPOyqKEgKX/8O

  Score

  10^/10

  gluptebametasploitbackdoordiscoverydropperevasionloaderpersistenceprivilege_escalationtrojanrootkit

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba family

    glupteba

  • Glupteba payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Windows security bypass

    evasiontrojan

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  behavioral1behavioral2