Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35f24ef20fa670f5057878f5a2352c758b0cfac06f8b042804ce2ce9fdd9c3cd

  • Size

    4.2MB

  • Sample

    230603-f95hcsga8x

  • MD5

    777a961b458144dcc1e428fd4cf79a72

  • SHA1

    bcf44cb4d037850e1e5a4e6de97d3c43181f24bc

  • SHA256

    35f24ef20fa670f5057878f5a2352c758b0cfac06f8b042804ce2ce9fdd9c3cd

  • SHA512

    6abbfbcae0dea3ea356e5257f49dc2bea7748c635659cd63afb52cbed0fee0ae1a60670b3d74ca813fac96afbff00181bed09f3bfff8ef33d9821f6e50842be4

  • SSDEEP

    98304:jKipW90ofNeezsyohVvDj++352zJxs3PfSyWbv53i49xY:OiShbwjn++ol6/MlN9xY

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      35f24ef20fa670f5057878f5a2352c758b0cfac06f8b042804ce2ce9fdd9c3cd

    • Size

      4.2MB

    • MD5

      777a961b458144dcc1e428fd4cf79a72

    • SHA1

      bcf44cb4d037850e1e5a4e6de97d3c43181f24bc

    • SHA256

      35f24ef20fa670f5057878f5a2352c758b0cfac06f8b042804ce2ce9fdd9c3cd

    • SHA512

      6abbfbcae0dea3ea356e5257f49dc2bea7748c635659cd63afb52cbed0fee0ae1a60670b3d74ca813fac96afbff00181bed09f3bfff8ef33d9821f6e50842be4

    • SSDEEP

      98304:jKipW90ofNeezsyohVvDj++352zJxs3PfSyWbv53i49xY:OiShbwjn++ol6/MlN9xY

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks