Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    23a84393a519d4d08706260bc10b7c32c0504baa301e6714cc2a41ad19188b49

  • Size

    4.1MB

  • Sample

    221103-fq8exahbgp

  • MD5

    d42885d6b4735ce23ab31678103e2fcd

  • SHA1

    83f4c2bd441465c09401f8ea274dd612579f6e9f

  • SHA256

    23a84393a519d4d08706260bc10b7c32c0504baa301e6714cc2a41ad19188b49

  • SHA512

    842b2137c14cbb8cc1ddd7fa0acbc217c29fe153a58a4924561f79688331f41dc9fda4dcb2891ab57912384c50b13b0bb252af9eebe551d60d65e012f537c116

  • SSDEEP

    98304:uXx03DnmGkfRfvBQO1ECzWhiuyVzLetqeVIEdDkmlUkh:fDm5Z3npzWcu8zLlEZkmzh

Score
10/10
gluptebadiscoverydropperevasionloaderpersistence

Malware Config

Targets

    • Target

      23a84393a519d4d08706260bc10b7c32c0504baa301e6714cc2a41ad19188b49

    • Size

      4.1MB

    • MD5

      d42885d6b4735ce23ab31678103e2fcd

    • SHA1

      83f4c2bd441465c09401f8ea274dd612579f6e9f

    • SHA256

      23a84393a519d4d08706260bc10b7c32c0504baa301e6714cc2a41ad19188b49

    • SHA512

      842b2137c14cbb8cc1ddd7fa0acbc217c29fe153a58a4924561f79688331f41dc9fda4dcb2891ab57912384c50b13b0bb252af9eebe551d60d65e012f537c116

    • SSDEEP

      98304:uXx03DnmGkfRfvBQO1ECzWhiuyVzLetqeVIEdDkmlUkh:fDm5Z3npzWcu8zLlEZkmzh

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistence

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks