Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    107ace7038d46513e34402794a7d35a559e2e7c24eadf38513021fcfb34833ed

  • Size

    4.1MB

  • Sample

    230323-pk4zzafe89

  • MD5

    2c0cb351ffe433aa20c5df0ad34ce946

  • SHA1

    8806656692b95ed0437292156f7ec9d90caa2b5c

  • SHA256

    107ace7038d46513e34402794a7d35a559e2e7c24eadf38513021fcfb34833ed

  • SHA512

    a3b114f30622173b9cf5461897593dac801dbae7e8a902650923d8462b9d71aef2f0405b1ccfb80d058fba93bb974ace97dab0d3f12e3d65f280f61cd07087fd

  • SSDEEP

    98304:PHIjvPWZ1zlvYEkikfPbt4kPD19ufs11CyEF9:fsv+rFkik3z8HN

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkit

Malware Config

Targets

    • Target

      107ace7038d46513e34402794a7d35a559e2e7c24eadf38513021fcfb34833ed

    • Size

      4.1MB

    • MD5

      2c0cb351ffe433aa20c5df0ad34ce946

    • SHA1

      8806656692b95ed0437292156f7ec9d90caa2b5c

    • SHA256

      107ace7038d46513e34402794a7d35a559e2e7c24eadf38513021fcfb34833ed

    • SHA512

      a3b114f30622173b9cf5461897593dac801dbae7e8a902650923d8462b9d71aef2f0405b1ccfb80d058fba93bb974ace97dab0d3f12e3d65f280f61cd07087fd

    • SSDEEP

      98304:PHIjvPWZ1zlvYEkikfPbt4kPD19ufs11CyEF9:fsv+rFkik3z8HN

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkit

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks