Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8efb497e27901aa555543adafba73f0ed31fcec8feec1e5d1c79034273955157

  • Size

    4.0MB

  • Sample

    221123-madc6agg8w

  • MD5

    1b5c8e0b8ea777420f8218d372e55171

  • SHA1

    e394c3f76a1b4f2134bf98316162f8590dedcf80

  • SHA256

    8efb497e27901aa555543adafba73f0ed31fcec8feec1e5d1c79034273955157

  • SHA512

    66d6aeb7dd48c3ce0ec2a558b30fd34552da7d7fc60985bcd62e2f2f3d88db77ec24a4ea36130a8e1e996278f06395bf6cedcae37b9aa89b3a46930fc5f027bc

  • SSDEEP

    98304:aoUXvqKpBkBJys8C+altxl1tbX5cLopGvZOv8VSq:a3xbkBJySxl1tlcLoIvZWq

Score
10/10
gluptebadiscoverydropperevasionloaderpersistence

Malware Config

Targets

    • Target

      8efb497e27901aa555543adafba73f0ed31fcec8feec1e5d1c79034273955157

    • Size

      4.0MB

    • MD5

      1b5c8e0b8ea777420f8218d372e55171

    • SHA1

      e394c3f76a1b4f2134bf98316162f8590dedcf80

    • SHA256

      8efb497e27901aa555543adafba73f0ed31fcec8feec1e5d1c79034273955157

    • SHA512

      66d6aeb7dd48c3ce0ec2a558b30fd34552da7d7fc60985bcd62e2f2f3d88db77ec24a4ea36130a8e1e996278f06395bf6cedcae37b9aa89b3a46930fc5f027bc

    • SSDEEP

      98304:aoUXvqKpBkBJys8C+altxl1tbX5cLopGvZOv8VSq:a3xbkBJySxl1tlcLoIvZWq

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistence

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks