Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    273a85f128d85321aee78ee28341eb42678702aa0fc9da27d74ea68c57a99bc3

  • Size

    4.1MB

  • Sample

    221031-tntqmabdd9

  • MD5

    275c78da61382c9c447e3ba77faa9d4f

  • SHA1

    81eaea5941842704e3d33a8a01903510ce52ea29

  • SHA256

    273a85f128d85321aee78ee28341eb42678702aa0fc9da27d74ea68c57a99bc3

  • SHA512

    35ea1be5a04c034bd0c8e2b0542e2ea1be2517b4c3d50a1dbcc0df004429e2e2d001f569f1df22d682ca5f174ff29247e51c36aa8998365a20de19d0821ad84c

  • SSDEEP

    98304:6qXIeiFqTyx5dmHbwyGNi+Ifucp+zZc1P/7COTe0xT/comBh8ISk0Y:HXhiFqTUdAGkJ5X7/gh871Y

Score
10/10
gluptebadiscoverydropperevasionloaderpersistenceupx

Malware Config

Targets

    • Target

      273a85f128d85321aee78ee28341eb42678702aa0fc9da27d74ea68c57a99bc3

    • Size

      4.1MB

    • MD5

      275c78da61382c9c447e3ba77faa9d4f

    • SHA1

      81eaea5941842704e3d33a8a01903510ce52ea29

    • SHA256

      273a85f128d85321aee78ee28341eb42678702aa0fc9da27d74ea68c57a99bc3

    • SHA512

      35ea1be5a04c034bd0c8e2b0542e2ea1be2517b4c3d50a1dbcc0df004429e2e2d001f569f1df22d682ca5f174ff29247e51c36aa8998365a20de19d0821ad84c

    • SSDEEP

      98304:6qXIeiFqTyx5dmHbwyGNi+Ifucp+zZc1P/7COTe0xT/comBh8ISk0Y:HXhiFqTUdAGkJ5X7/gh871Y

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistenceupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks