Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7bd53b8e29fa06f630fb0b20ad78c1ab509256fbb1212e25213d19e19b423c5e

  • Size

    4.1MB

  • Sample

    230329-p8gvcahh8v

  • MD5

    ebc9739befd1b7c18d404db70d9a1990

  • SHA1

    9cd9e598be7715399ae3fb0fe719ddbf30bb08ce

  • SHA256

    7bd53b8e29fa06f630fb0b20ad78c1ab509256fbb1212e25213d19e19b423c5e

  • SHA512

    f4882cccd55375dccbd72c05275ec5d756e4066c21f47db5b4186dec1e839b37c8a084cd532a5f49988c19b41d3058ec65103b7251b6c7ef4a39139fff9c366c

  • SSDEEP

    98304:BCMWkp86c+ThfVhOb/JsHgMk0RJaaLNBcSCO4FN+QrSckbHq:LWk2L+13UyHgb+auNuxfFjrbkbK

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkit

Malware Config

Targets

    • Target

      7bd53b8e29fa06f630fb0b20ad78c1ab509256fbb1212e25213d19e19b423c5e

    • Size

      4.1MB

    • MD5

      ebc9739befd1b7c18d404db70d9a1990

    • SHA1

      9cd9e598be7715399ae3fb0fe719ddbf30bb08ce

    • SHA256

      7bd53b8e29fa06f630fb0b20ad78c1ab509256fbb1212e25213d19e19b423c5e

    • SHA512

      f4882cccd55375dccbd72c05275ec5d756e4066c21f47db5b4186dec1e839b37c8a084cd532a5f49988c19b41d3058ec65103b7251b6c7ef4a39139fff9c366c

    • SSDEEP

      98304:BCMWkp86c+ThfVhOb/JsHgMk0RJaaLNBcSCO4FN+QrSckbHq:LWk2L+13UyHgb+auNuxfFjrbkbK

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkit

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks