Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f393a30d2a5ace677c098e8b4ee790a6ddca34afbc38f19b800a3b2fa6b7f09b

  • Size

    4.2MB

  • Sample

    230808-fnzpzscc4x

  • MD5

    a12795dd1f25db0b89ed0aa5647d4f99

  • SHA1

    16304b11a70c99031eba45095aa11e7f0410209e

  • SHA256

    f393a30d2a5ace677c098e8b4ee790a6ddca34afbc38f19b800a3b2fa6b7f09b

  • SHA512

    2d6cb99f61ec8fc88bdd83f86ca514ced0799cf956044a42f92a5cec1b496f935e255de7b89e6d44a961d0b0349c4efaa60d51556fcc8e7d8dbfa4ecb2d98158

  • SSDEEP

    98304:97KhZewihuTkDiVkC+BU1Z5qSDeXjE2KZLQmjoaCdKosoTg:97KjHihu1+C+aP5qFTEKm4dVdTg

Score
10/10
gluptebadropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      f393a30d2a5ace677c098e8b4ee790a6ddca34afbc38f19b800a3b2fa6b7f09b

    • Size

      4.2MB

    • MD5

      a12795dd1f25db0b89ed0aa5647d4f99

    • SHA1

      16304b11a70c99031eba45095aa11e7f0410209e

    • SHA256

      f393a30d2a5ace677c098e8b4ee790a6ddca34afbc38f19b800a3b2fa6b7f09b

    • SHA512

      2d6cb99f61ec8fc88bdd83f86ca514ced0799cf956044a42f92a5cec1b496f935e255de7b89e6d44a961d0b0349c4efaa60d51556fcc8e7d8dbfa4ecb2d98158

    • SSDEEP

      98304:97KhZewihuTkDiVkC+BU1Z5qSDeXjE2KZLQmjoaCdKosoTg:97KjHihu1+C+aP5qFTEKm4dVdTg

    Score
    10/10
    gluptebadropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks