Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ccc3b96a4cc0cf390c4da26288b5d20c70a014b008e6dc5fe217aac5c4db996e

  • Size

    4.1MB

  • Sample

    230304-1eadyseh65

  • MD5

    005e6bb99247221ff5b08448a7c75916

  • SHA1

    dcc493a25ce124e18675a1071fe032deab203d49

  • SHA256

    ccc3b96a4cc0cf390c4da26288b5d20c70a014b008e6dc5fe217aac5c4db996e

  • SHA512

    63a91f8d3e8a25f7b1aebf1de4c5737a18fda079f2b86e91b1c0ea70219da42e7f80bac1eaf1e4be8b1e6c8f99e8fb42857af98e0ec0e082d64bb27a7b1ea391

  • SSDEEP

    98304:RrHBLhZOhYchREeHgbCneM1wEDbYWuhhiBFC90xMVkznsocObGMxvO:btZOachRtCDmwEDbYWsIvC90SezsoFdQ

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkit

Malware Config

Targets

    • Target

      ccc3b96a4cc0cf390c4da26288b5d20c70a014b008e6dc5fe217aac5c4db996e

    • Size

      4.1MB

    • MD5

      005e6bb99247221ff5b08448a7c75916

    • SHA1

      dcc493a25ce124e18675a1071fe032deab203d49

    • SHA256

      ccc3b96a4cc0cf390c4da26288b5d20c70a014b008e6dc5fe217aac5c4db996e

    • SHA512

      63a91f8d3e8a25f7b1aebf1de4c5737a18fda079f2b86e91b1c0ea70219da42e7f80bac1eaf1e4be8b1e6c8f99e8fb42857af98e0ec0e082d64bb27a7b1ea391

    • SSDEEP

      98304:RrHBLhZOhYchREeHgbCneM1wEDbYWuhhiBFC90xMVkznsocObGMxvO:btZOachRtCDmwEDbYWsIvC90SezsoFdQ

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkit

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks