Extracted

• • Target
    2026-09-01_d0d240d42089595a8f44e59463aa0f76_amadey_dharma_elex_smoke-loader_stop
  • Size 4.4MB
  • SHA256 4cffbd9695aa93753b3865ffa5afdcec3a3afeb50854f1ea2b15a135c45c293d
  • MD5 d0d240d42089595a8f44e59463aa0f76
  • SHA1 e59379f24497c0f5cafb081846efc66d05a1d8b1
  • SHA512 f624886ef2e5b0abd495f6566009453f5890ea8b96287785d1481ec6b9efa8391eaa941ee830e144ae69ea128fe4c8a8d18cd4160ff01d6867daf17879aea430
  • SSDEEP 98304:Fi6azOpYtbhm9L9/b1zGNZafEW+6g62zMUpfr7A820cTPY:FR6m+FwpG6fBIgufr7A82u
  • TLSH
    T15D263320E6D0C03AE1762AF1B5B58771682E7DB4EB3415CF63E12AD857309E48D713AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverydropperexecutiongluptebametasploitloaderpersistenceprivilege_escalationrootkittrojan

  • Family: Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Glupteba payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables referencing many varying, potentially fake Windows User-Agents

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitdefense_evasion
  behavioral1behavioral2