Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0b4d49eb1c454653f25f6810d0b5c8f8b792bfe63d6d033d68c5624e160081ce

  • Size

    4.1MB

  • Sample

    230601-mgm6yaeb9x

  • MD5

    4a3b1141dc0b3fa01bab4c4be8435100

  • SHA1

    2918211547b5422ff9c449a72905dba3aa3956a4

  • SHA256

    0b4d49eb1c454653f25f6810d0b5c8f8b792bfe63d6d033d68c5624e160081ce

  • SHA512

    dd9f3a75b7c7ba63244aac01ad53421d68f07953b57e428dc51d2897f956a7639ebe58b61861e8758d2405a05025a4af5f3fd171c2a56280574b10a248cad392

  • SSDEEP

    98304:n65yV67DZMITzfJ3oVQfoMhuwzprfPfmqwgIRS57:65t2IPJTfotwzpjP/wgIRS57

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      0b4d49eb1c454653f25f6810d0b5c8f8b792bfe63d6d033d68c5624e160081ce

    • Size

      4.1MB

    • MD5

      4a3b1141dc0b3fa01bab4c4be8435100

    • SHA1

      2918211547b5422ff9c449a72905dba3aa3956a4

    • SHA256

      0b4d49eb1c454653f25f6810d0b5c8f8b792bfe63d6d033d68c5624e160081ce

    • SHA512

      dd9f3a75b7c7ba63244aac01ad53421d68f07953b57e428dc51d2897f956a7639ebe58b61861e8758d2405a05025a4af5f3fd171c2a56280574b10a248cad392

    • SSDEEP

      98304:n65yV67DZMITzfJ3oVQfoMhuwzprfPfmqwgIRS57:65t2IPJTfotwzpjP/wgIRS57

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks