Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad2c7a146f5034db71713a8f70096e69ee922efc9d3591cbc72800d9d34e4c22

  • Size

    4.1MB

  • Sample

    221103-am2v3adac9

  • MD5

    a15e3797ef9327a7e3baf0e694c6ac5e

  • SHA1

    8187b6ef432d924b7382d2f0b40f4b88510c12ab

  • SHA256

    ad2c7a146f5034db71713a8f70096e69ee922efc9d3591cbc72800d9d34e4c22

  • SHA512

    fdf76acf5e05c0dc8b8529d72f56506386448655784441814f58064f78beaec42a81387e3f86af778c11d9273a6b9e9a24363b465bc7de711b8b18c7c4d0119c

  • SSDEEP

    98304:UdFAzftJueZlZWGMmbpMaKVi1gfsb/cY4zwqtz+UM:wqtPOupMni14NW

Score
10/10
gluptebadiscoverydropperevasionloaderpersistenceupx

Malware Config

Targets

    • Target

      ad2c7a146f5034db71713a8f70096e69ee922efc9d3591cbc72800d9d34e4c22

    • Size

      4.1MB

    • MD5

      a15e3797ef9327a7e3baf0e694c6ac5e

    • SHA1

      8187b6ef432d924b7382d2f0b40f4b88510c12ab

    • SHA256

      ad2c7a146f5034db71713a8f70096e69ee922efc9d3591cbc72800d9d34e4c22

    • SHA512

      fdf76acf5e05c0dc8b8529d72f56506386448655784441814f58064f78beaec42a81387e3f86af778c11d9273a6b9e9a24363b465bc7de711b8b18c7c4d0119c

    • SSDEEP

      98304:UdFAzftJueZlZWGMmbpMaKVi1gfsb/cY4zwqtz+UM:wqtPOupMni14NW

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistenceupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks