Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5efc572151aad66d89985a1f38c8c8d878a7bb98b9390c1329d290f3d4192b37

  • Size

    4.0MB

  • Sample

    230215-wsvjtsda3y

  • MD5

    5e9ab34252a37b2a91a7406b997ece7d

  • SHA1

    10579e6c6122f8f44b1d5adf1e72b3dc97a91cf5

  • SHA256

    5efc572151aad66d89985a1f38c8c8d878a7bb98b9390c1329d290f3d4192b37

  • SHA512

    0cc948ceb9f23dff63558a9655f5b86507366aa26f2c9f5e4e8ffab58fa45acc43b454e604bba7c89f3efb2cc52c6916d1171f45426a029a0fa704c2a5c91f14

  • SSDEEP

    98304:TD3H9mOnDwuBCmrIfbH6X0bh2xTTBfsYFMFBGwo2UxZk3DL6ygK:TDxDbBTThseMuZ83H6yt

Score
10/10
gluptebadiscoverydropperevasionloaderpersistenceupx

Malware Config

Targets

    • Target

      5efc572151aad66d89985a1f38c8c8d878a7bb98b9390c1329d290f3d4192b37

    • Size

      4.0MB

    • MD5

      5e9ab34252a37b2a91a7406b997ece7d

    • SHA1

      10579e6c6122f8f44b1d5adf1e72b3dc97a91cf5

    • SHA256

      5efc572151aad66d89985a1f38c8c8d878a7bb98b9390c1329d290f3d4192b37

    • SHA512

      0cc948ceb9f23dff63558a9655f5b86507366aa26f2c9f5e4e8ffab58fa45acc43b454e604bba7c89f3efb2cc52c6916d1171f45426a029a0fa704c2a5c91f14

    • SSDEEP

      98304:TD3H9mOnDwuBCmrIfbH6X0bh2xTTBfsYFMFBGwo2UxZk3DL6ygK:TDxDbBTThseMuZ83H6yt

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistenceupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks