Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b95d39e3a37f70aa9f4a755f919ae58692b575811d4a66859dc15f49d6f39cc5

  • Size

    4.2MB

  • Sample

    230508-wlmweadg21

  • MD5

    28db8cf738ff0860946c68b66a4f955d

  • SHA1

    4e61c41a261a310244b8f7334403e3ea00245b9b

  • SHA256

    b95d39e3a37f70aa9f4a755f919ae58692b575811d4a66859dc15f49d6f39cc5

  • SHA512

    b8dd27b8a7f80a8721004c0c0e73ebca250276a24805b9ade12bfe2fc777f32c99c07fecb53cb8eed4c6f37a40d23ff69c4a8651775720c52a761c66c63a2475

  • SSDEEP

    98304:0AQOAx9nJPDXwDie4fPglhUGex0ElG3ClgsKrnpxZx:HQOA3nGyPcxz3ggsKrnpXx

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkit

Malware Config

Targets

    • Target

      b95d39e3a37f70aa9f4a755f919ae58692b575811d4a66859dc15f49d6f39cc5

    • Size

      4.2MB

    • MD5

      28db8cf738ff0860946c68b66a4f955d

    • SHA1

      4e61c41a261a310244b8f7334403e3ea00245b9b

    • SHA256

      b95d39e3a37f70aa9f4a755f919ae58692b575811d4a66859dc15f49d6f39cc5

    • SHA512

      b8dd27b8a7f80a8721004c0c0e73ebca250276a24805b9ade12bfe2fc777f32c99c07fecb53cb8eed4c6f37a40d23ff69c4a8651775720c52a761c66c63a2475

    • SSDEEP

      98304:0AQOAx9nJPDXwDie4fPglhUGex0ElG3ClgsKrnpxZx:HQOA3nGyPcxz3ggsKrnpXx

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkit

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks