Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    491c9426c3d39f1101309b07de0aead2f9f6a8aedb4c604b2c3e8a0c19784ce2

  • Size

    4.2MB

  • Sample

    221204-k358jaec97

  • MD5

    78c53eb0a4e18f14150d5382e39ecd90

  • SHA1

    61461f9cd2762c613d1ab852297b516cfd79ee94

  • SHA256

    491c9426c3d39f1101309b07de0aead2f9f6a8aedb4c604b2c3e8a0c19784ce2

  • SHA512

    aa3b17e37409a95a1db98b1777e6478385719a5d6637c7fcd2d8d883e33252551dd7947eff0257518dc3f3b4df5b6a5168a64e1a05a110259d9d56d91daa7ce2

  • SSDEEP

    98304:sPAFFlmUNtom1XY26n6OoZIJOU4cQtC3NKZTANiV7Foe95Bxp:t7m0tftYDo6P5QtnZ8oTrxp

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      491c9426c3d39f1101309b07de0aead2f9f6a8aedb4c604b2c3e8a0c19784ce2

    • Size

      4.2MB

    • MD5

      78c53eb0a4e18f14150d5382e39ecd90

    • SHA1

      61461f9cd2762c613d1ab852297b516cfd79ee94

    • SHA256

      491c9426c3d39f1101309b07de0aead2f9f6a8aedb4c604b2c3e8a0c19784ce2

    • SHA512

      aa3b17e37409a95a1db98b1777e6478385719a5d6637c7fcd2d8d883e33252551dd7947eff0257518dc3f3b4df5b6a5168a64e1a05a110259d9d56d91daa7ce2

    • SSDEEP

      98304:sPAFFlmUNtom1XY26n6OoZIJOU4cQtC3NKZTANiV7Foe95Bxp:t7m0tftYDo6P5QtnZ8oTrxp

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencetrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks