Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a63b59e071d85518ae347b40a82deeb693ba13687d9c97560df860849f9c76fa

  • Size

    4.0MB

  • Sample

    221127-j35rbsfd9w

  • MD5

    c3bb44c0f93ce7714aa9c7b3eba5a828

  • SHA1

    3b6de1237daf1d3669889b9ddd323f468f73bbda

  • SHA256

    a63b59e071d85518ae347b40a82deeb693ba13687d9c97560df860849f9c76fa

  • SHA512

    225ff15c757542d041d0053a93b0894862f83312a81a89dc96d8312fe38316a1c6df78eb18c96cb6c10d23d5d0e3ad2b0d426b30b6ff20fd3c11c9ce98442cb7

  • SSDEEP

    98304:n3UAscWf9xKuHXYcm2fo5Yl4PxohvaSb3+2AUgX1MT6Wu4+Kn0Q:nkR9suHffeohySb3+2TgX1MOWu4zn0Q

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      a63b59e071d85518ae347b40a82deeb693ba13687d9c97560df860849f9c76fa

    • Size

      4.0MB

    • MD5

      c3bb44c0f93ce7714aa9c7b3eba5a828

    • SHA1

      3b6de1237daf1d3669889b9ddd323f468f73bbda

    • SHA256

      a63b59e071d85518ae347b40a82deeb693ba13687d9c97560df860849f9c76fa

    • SHA512

      225ff15c757542d041d0053a93b0894862f83312a81a89dc96d8312fe38316a1c6df78eb18c96cb6c10d23d5d0e3ad2b0d426b30b6ff20fd3c11c9ce98442cb7

    • SSDEEP

      98304:n3UAscWf9xKuHXYcm2fo5Yl4PxohvaSb3+2AUgX1MT6Wu4+Kn0Q:nkR9suHffeohySb3+2TgX1MOWu4zn0Q

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencetrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks