Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc345ca6f238c14e1c847a20b620ced3a30e7485ed5c34d0d6cada08e5843600

  • Size

    4.1MB

  • Sample

    230330-gcq45sbb23

  • MD5

    1554fc689ba3f62bd4a4004cd230e32c

  • SHA1

    fa7e5a84d67881accf89692771da70b598a8df92

  • SHA256

    cc345ca6f238c14e1c847a20b620ced3a30e7485ed5c34d0d6cada08e5843600

  • SHA512

    a96984a0bf31ff3c3874757abc7e9925bf8191a3900b5ccad54051c647047c17d47bba74e81ebbe0d0c3fa17381c19a4dbca9919b7625818367f406146d72596

  • SSDEEP

    98304:+VEC2ltsEMdiZwgSa4s8vEus6m0t0+n/3TQZs:R5lGEMdimjMGmYz/3Ws

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkit

Malware Config

Targets

    • Target

      cc345ca6f238c14e1c847a20b620ced3a30e7485ed5c34d0d6cada08e5843600

    • Size

      4.1MB

    • MD5

      1554fc689ba3f62bd4a4004cd230e32c

    • SHA1

      fa7e5a84d67881accf89692771da70b598a8df92

    • SHA256

      cc345ca6f238c14e1c847a20b620ced3a30e7485ed5c34d0d6cada08e5843600

    • SHA512

      a96984a0bf31ff3c3874757abc7e9925bf8191a3900b5ccad54051c647047c17d47bba74e81ebbe0d0c3fa17381c19a4dbca9919b7625818367f406146d72596

    • SSDEEP

      98304:+VEC2ltsEMdiZwgSa4s8vEus6m0t0+n/3TQZs:R5lGEMdimjMGmYz/3Ws

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkit

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks