Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76ef96b5551efd555313d1319bd635b10221aa0ffbc9bda35f1d0962d1bc8243

  • Size

    4.1MB

  • Sample

    220919-j8dj2afhh6

  • MD5

    15f1bb4b7434806f7c678280d6b624df

  • SHA1

    6120e46d108ae9e5271da4e4471a60e4eb7a25f2

  • SHA256

    76ef96b5551efd555313d1319bd635b10221aa0ffbc9bda35f1d0962d1bc8243

  • SHA512

    3fc5e8b318fd1550729f40fad6130448d6589ce7ed9a4645adc421e3a71c73cd3674b6b21678788f9db490b176c6c0957dd30f854bb743016fa7efa8d3ea288e

  • SSDEEP

    98304:A4V/hDk9ELT/obmAX8BbRiM/0F5JHgdjdMyO9NGi/uWWBQ1GCP:jh49UDo7X8BbUMG5mZuyswi/Z5

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      76ef96b5551efd555313d1319bd635b10221aa0ffbc9bda35f1d0962d1bc8243

    • Size

      4.1MB

    • MD5

      15f1bb4b7434806f7c678280d6b624df

    • SHA1

      6120e46d108ae9e5271da4e4471a60e4eb7a25f2

    • SHA256

      76ef96b5551efd555313d1319bd635b10221aa0ffbc9bda35f1d0962d1bc8243

    • SHA512

      3fc5e8b318fd1550729f40fad6130448d6589ce7ed9a4645adc421e3a71c73cd3674b6b21678788f9db490b176c6c0957dd30f854bb743016fa7efa8d3ea288e

    • SSDEEP

      98304:A4V/hDk9ELT/obmAX8BbRiM/0F5JHgdjdMyO9NGi/uWWBQ1GCP:jh49UDo7X8BbUMG5mZuyswi/Z5

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencetrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks