Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bebfed4d2699e5482ee08cddb36b96ae5143a417296d5dccdd8e33b6d649096f

  • Size

    4.1MB

  • Sample

    230319-ny2w4agb87

  • MD5

    45b3596681b86e5e83ca7c2540be0f67

  • SHA1

    0fe869b8b3991affc5ddf3dc412517649cd8b657

  • SHA256

    bebfed4d2699e5482ee08cddb36b96ae5143a417296d5dccdd8e33b6d649096f

  • SHA512

    c5261d569987d6b7293359f9360bfb67950199027d8ebd8c018fec9c55471ac5424ad4a4348985361775f90312e7082e450eb233ed5c3afad9a5bc1328bc4cd0

  • SSDEEP

    49152:qH7YqBHn2TQHHb9E32iQ90QhKii1t0kDLtcX+UEqAyebB78QFiwp/xie++13nhMV:q8uHn3NL/iz0kDLWExN7jfzNhgh

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

Malware Config

Targets

    • Target

      bebfed4d2699e5482ee08cddb36b96ae5143a417296d5dccdd8e33b6d649096f

    • Size

      4.1MB

    • MD5

      45b3596681b86e5e83ca7c2540be0f67

    • SHA1

      0fe869b8b3991affc5ddf3dc412517649cd8b657

    • SHA256

      bebfed4d2699e5482ee08cddb36b96ae5143a417296d5dccdd8e33b6d649096f

    • SHA512

      c5261d569987d6b7293359f9360bfb67950199027d8ebd8c018fec9c55471ac5424ad4a4348985361775f90312e7082e450eb233ed5c3afad9a5bc1328bc4cd0

    • SSDEEP

      49152:qH7YqBHn2TQHHb9E32iQ90QhKii1t0kDLtcX+UEqAyebB78QFiwp/xie++13nhMV:q8uHn3NL/iz0kDLWExN7jfzNhgh

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks