Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d76fe0d964e6a591092a764fe42dd976ef424e2682c723954088d8e9dba1617d

  • Size

    4.1MB

  • Sample

    230816-lzt7jaaa57

  • MD5

    bd72cd82e3f5e372965590406aed836f

  • SHA1

    a0209a0f6405a4d04285601a032c047d8d275752

  • SHA256

    d76fe0d964e6a591092a764fe42dd976ef424e2682c723954088d8e9dba1617d

  • SHA512

    e2916afb7c8caecae50bdb1eaf14c4e2dc19111af88cc16a7cc00dbf323c5473bb3e3b23dfe18a8bc4139edbd5678fec518b45add75abae4c0199388c5f106af

  • SSDEEP

    98304:Xf68tSsi2YSbbbIDc+5WwegUEmnvVzXDn7row4YrcwAHU1/2k:iEpi2YSnbIgUWw0EIvFXvkwzQo/5

Score
10/10
gluptebadropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      d76fe0d964e6a591092a764fe42dd976ef424e2682c723954088d8e9dba1617d

    • Size

      4.1MB

    • MD5

      bd72cd82e3f5e372965590406aed836f

    • SHA1

      a0209a0f6405a4d04285601a032c047d8d275752

    • SHA256

      d76fe0d964e6a591092a764fe42dd976ef424e2682c723954088d8e9dba1617d

    • SHA512

      e2916afb7c8caecae50bdb1eaf14c4e2dc19111af88cc16a7cc00dbf323c5473bb3e3b23dfe18a8bc4139edbd5678fec518b45add75abae4c0199388c5f106af

    • SSDEEP

      98304:Xf68tSsi2YSbbbIDc+5WwegUEmnvVzXDn7row4YrcwAHU1/2k:iEpi2YSnbIgUWw0EIvFXvkwzQo/5

    Score
    10/10
    gluptebadropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks