Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3208e83f4e0424f5f6648ebd60fc79febc6cb91590f5fefa324ea094904b046

  • Size

    4.1MB

  • Sample

    230329-jlh61afc77

  • MD5

    9e9fde4123b4c014b10d02882ecb4d18

  • SHA1

    860034ef167de36b4c3d141d8bc556fc220d6e21

  • SHA256

    c3208e83f4e0424f5f6648ebd60fc79febc6cb91590f5fefa324ea094904b046

  • SHA512

    cc1f36700100de2e348f5673fb54e66cc79c70da42e5dd7008d50fe99da069396148bb63255ae1b4295de196d37b616944cc985ae2da319a0c9f255ca611f808

  • SSDEEP

    98304:fW4FkGrzhLMOTvhVFfVuonqfevvibb7iZVbmcTXxyf92/lWz/u:fnFkG/pMmZzNuLfeY7ybHE2D

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

Malware Config

Targets

    • Target

      c3208e83f4e0424f5f6648ebd60fc79febc6cb91590f5fefa324ea094904b046

    • Size

      4.1MB

    • MD5

      9e9fde4123b4c014b10d02882ecb4d18

    • SHA1

      860034ef167de36b4c3d141d8bc556fc220d6e21

    • SHA256

      c3208e83f4e0424f5f6648ebd60fc79febc6cb91590f5fefa324ea094904b046

    • SHA512

      cc1f36700100de2e348f5673fb54e66cc79c70da42e5dd7008d50fe99da069396148bb63255ae1b4295de196d37b616944cc985ae2da319a0c9f255ca611f808

    • SSDEEP

      98304:fW4FkGrzhLMOTvhVFfVuonqfevvibb7iZVbmcTXxyf92/lWz/u:fnFkG/pMmZzNuLfeY7ybHE2D

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks