glupteba | 86a332e9bc6c883eef2e7022a48f13f912d54fdee8a9c666682dac84a253424b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 04:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_94e88eb1adf5394186c4d79cd02a38f3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 4.4MB
Sample260824-fjse4sshqa
SHA256 86a332e9bc6c883eef2e7022a48f13f912d54fdee8a9c666682dac84a253424b
MD5 94e88eb1adf5394186c4d79cd02a38f3
SHA1 bb0c217c7abc0b346e520c4c5a514dbdcb61861e
SHA512 bb38144122b20796bd507ad03ad229f81a4218c7b611be1f6f220b53316bb6ee3e9f8dbdc073f16619e8ca04e32d67d8f6b33b01cf8e9422850cafa1237cbb7b
SSDEEP 98304:iQRi8rzyu4absB48jEzr5ufxD7k4eArxz3JAq6v:iQRiiKabU4YEzFux04fxWlv
TLSH
T1AE2633757E80E4BAE7E184BBC5A89F40206FFCD31E8485C6735322AA1D274C4A5EF587
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery dropper glupteba metasploit loader trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/memory/2320-2-0x0000000005410000-0x0000000005D36000-memory.dmp	family_glupteba

Program crash 1 IoCs

pid	pid_target	Process	procid_target
236	2320	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_94e88eb1adf5394186c4d79cd02a38f3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_94e88eb1adf5394186c4d79cd02a38f3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_94e88eb1adf5394186c4d79cd02a38f3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 312
  2⤵
  - Program crash
  PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2320 -ip 2320
1⤵
PID:380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-1-0x0000000004FD0000-0x0000000005410000-memory.dmp

Download

memory/2320-2-0x0000000005410000-0x0000000005D36000-memory.dmp