Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7eaa0a38218eec7faf1cf3033a334e1b4e149d564e07359663fc9c8e2f016914

  • Size

    4.1MB

  • Sample

    230517-jmhlvsdb81

  • MD5

    b7acb12ea98b3700984a0f19cbbf7200

  • SHA1

    a1900c5e67e75c0375513aa34aa9feee5302a70b

  • SHA256

    7eaa0a38218eec7faf1cf3033a334e1b4e149d564e07359663fc9c8e2f016914

  • SHA512

    5eb7f7c46eb09349970e13690ae408686afb34b2ec527b8bb484c511a6ab6e8fa8c1849f3f9365ebbe119e6b4ecaab5f321a389c3de929a340020458984ddbd8

  • SSDEEP

    98304:Zjif8FZudU++UIkHJxPAyyjYAVXw9HHOyb5OMfh:Yf8Fs/xJx4iGuHH795

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      7eaa0a38218eec7faf1cf3033a334e1b4e149d564e07359663fc9c8e2f016914

    • Size

      4.1MB

    • MD5

      b7acb12ea98b3700984a0f19cbbf7200

    • SHA1

      a1900c5e67e75c0375513aa34aa9feee5302a70b

    • SHA256

      7eaa0a38218eec7faf1cf3033a334e1b4e149d564e07359663fc9c8e2f016914

    • SHA512

      5eb7f7c46eb09349970e13690ae408686afb34b2ec527b8bb484c511a6ab6e8fa8c1849f3f9365ebbe119e6b4ecaab5f321a389c3de929a340020458984ddbd8

    • SSDEEP

      98304:Zjif8FZudU++UIkHJxPAyyjYAVXw9HHOyb5OMfh:Yf8Fs/xJx4iGuHH795

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks