Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    82731d64bc4b03de0e59f310d2d9b102b92de385a35198f23a6af0b7a34e4a36

  • Size

    4.1MB

  • Sample

    230208-gf6zrsgg61

  • MD5

    0fad3a97b8c1c3efe3ad266fb7735c3c

  • SHA1

    26351ac752857f5be66e1188223bc723eeec1e05

  • SHA256

    82731d64bc4b03de0e59f310d2d9b102b92de385a35198f23a6af0b7a34e4a36

  • SHA512

    a4e4b5a286b2c302654ec3f711a0454fd3b28c2390e16829f058eef1e9b6f276024882bfe26cb76d4f762b925c5b94cb6a4c2cb130a534bc703485421d328c81

  • SSDEEP

    98304:u2UXIGTI8ZPfSskTpNqEW0oyJPMfltxva57VMxayMH:+YG5aNi07JkLZ+7VdT

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      82731d64bc4b03de0e59f310d2d9b102b92de385a35198f23a6af0b7a34e4a36

    • Size

      4.1MB

    • MD5

      0fad3a97b8c1c3efe3ad266fb7735c3c

    • SHA1

      26351ac752857f5be66e1188223bc723eeec1e05

    • SHA256

      82731d64bc4b03de0e59f310d2d9b102b92de385a35198f23a6af0b7a34e4a36

    • SHA512

      a4e4b5a286b2c302654ec3f711a0454fd3b28c2390e16829f058eef1e9b6f276024882bfe26cb76d4f762b925c5b94cb6a4c2cb130a534bc703485421d328c81

    • SSDEEP

      98304:u2UXIGTI8ZPfSskTpNqEW0oyJPMfltxva57VMxayMH:+YG5aNi07JkLZ+7VdT

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencetrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks