Extracted

• • Target
    2026-11-03_c2013eb7b39e09d2bd9423c6a4be44c1_amadey_elex_smoke-loader
  • Size 4.3MB
  • SHA256 8817950db1ec088ed70d42bd00c9a0f08d38d56425ff72e467aef21b16b4a21d
  • MD5 c2013eb7b39e09d2bd9423c6a4be44c1
  • SHA1 b6aaf8d5dc590fb068f0fd39c0492e0369ad9ab9
  • SHA512 243ebd4a803f8cbdf7538089fff83c973428564c536125f37a7bc72e0aede14ca9058f3763cc0dc41a0e87870fd39466d446664d2131a403b119cae5eb68d747
  • SSDEEP 98304:0H9EsZm8LJkMf7y813FIlUeiUKudjhkl5i2SvBBHPIHNz4C3lXni:KZmac8rIObdLSvBBwtsC3l3i
  • TLSH
    T1B82633207BB04535E1FA12FA46A49AAC693FBDD25B3491CF73A12ADA5A347C0DC31317
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverydropperexecutiongluptebametasploitloaderpersistenceprivilege_escalationrootkittrojan

  • Family: Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Glupteba payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables referencing many varying, potentially fake Windows User-Agents

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitdefense_evasion
  behavioral1behavioral2