Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    436fc03f5df2eb9c408fb3894f02e40e520a0eae3bb769ee04c2580684d677bd

  • Size

    4.1MB

  • Sample

    220914-sv327safg5

  • MD5

    fbbf2995ac61418876f72380daa21841

  • SHA1

    65f0cab20264ac3aef911b3ebef0c64ff3f2a2a2

  • SHA256

    436fc03f5df2eb9c408fb3894f02e40e520a0eae3bb769ee04c2580684d677bd

  • SHA512

    afb3487740a82c26e8efb64924853e0a8d9d47b243c9764f1a835b8d303b64716d488a358d1136628d2d8896c5bd4f81557846ab4c14753a4355a3a7025f0af9

  • SSDEEP

    98304:EkgrM7q8LTIRg2vy+Mi0+xFUYZLPBDk302TUURzVwDHO:EkgrWq+cRevoq8hk3HhRZw7O

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      436fc03f5df2eb9c408fb3894f02e40e520a0eae3bb769ee04c2580684d677bd

    • Size

      4.1MB

    • MD5

      fbbf2995ac61418876f72380daa21841

    • SHA1

      65f0cab20264ac3aef911b3ebef0c64ff3f2a2a2

    • SHA256

      436fc03f5df2eb9c408fb3894f02e40e520a0eae3bb769ee04c2580684d677bd

    • SHA512

      afb3487740a82c26e8efb64924853e0a8d9d47b243c9764f1a835b8d303b64716d488a358d1136628d2d8896c5bd4f81557846ab4c14753a4355a3a7025f0af9

    • SSDEEP

      98304:EkgrM7q8LTIRg2vy+Mi0+xFUYZLPBDk302TUURzVwDHO:EkgrWq+cRevoq8hk3HhRZw7O

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencetrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks