Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e3aeca6bccf3bb98fec75f9f7a85943b1f2ecdc27c3722a03b990a4742ec0c61

  • Size

    4.0MB

  • Sample

    230216-ah91waeh38

  • MD5

    b1a29c2e4ea1f19cf70058b732f7b144

  • SHA1

    b46129d24a98d26aa087d0fdb3945a8646b9e770

  • SHA256

    e3aeca6bccf3bb98fec75f9f7a85943b1f2ecdc27c3722a03b990a4742ec0c61

  • SHA512

    5e6c67ede08a9809fefe644feb608147f3ce7d18c0bd97943be89ae431728130501a07cf1fab61f18215e3c17e00952d750935339c47f5c1a2f4f4e98843c4f7

  • SSDEEP

    98304:yAjY6cAg5JfkzqPgCElHZNQUZI0H3nbzE7VsuIWCPW+KB:R+JjElHwsI0HLo7VyzKB

Score
10/10
gluptebadiscoverydropperevasionloaderpersistence

Malware Config

Targets

    • Target

      e3aeca6bccf3bb98fec75f9f7a85943b1f2ecdc27c3722a03b990a4742ec0c61

    • Size

      4.0MB

    • MD5

      b1a29c2e4ea1f19cf70058b732f7b144

    • SHA1

      b46129d24a98d26aa087d0fdb3945a8646b9e770

    • SHA256

      e3aeca6bccf3bb98fec75f9f7a85943b1f2ecdc27c3722a03b990a4742ec0c61

    • SHA512

      5e6c67ede08a9809fefe644feb608147f3ce7d18c0bd97943be89ae431728130501a07cf1fab61f18215e3c17e00952d750935339c47f5c1a2f4f4e98843c4f7

    • SSDEEP

      98304:yAjY6cAg5JfkzqPgCElHZNQUZI0H3nbzE7VsuIWCPW+KB:R+JjElHwsI0HLo7VyzKB

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistence

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks