Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b025d3d0c88c174d461d80e15edc2f37845aba0534f144dee7470598bc06bb08

  • Size

    4.2MB

  • Sample

    230823-ebyfqaba4y

  • MD5

    d309bdeda60bccf5b57598fc289b8dc5

  • SHA1

    5dc8705b0d02a70e008cb4d95ca0ae1bda182710

  • SHA256

    b025d3d0c88c174d461d80e15edc2f37845aba0534f144dee7470598bc06bb08

  • SHA512

    f5dc6081a9c2210adf31eded0bcdff2cf98a3de4a5394ba4ce9d621ee5caf1458614cbcb26e7da9c2199a8e19555a85e1d8f148b66089e9d86647288de9876e8

  • SSDEEP

    98304:B897bZFFVANh0e8QxwXESctVy1vK+CHlAic5tX8ivY/4TpYwIJ:CjINh5x+dcjsvK+C+icH7+8kJ

Score
10/10
gluptebadropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      b025d3d0c88c174d461d80e15edc2f37845aba0534f144dee7470598bc06bb08

    • Size

      4.2MB

    • MD5

      d309bdeda60bccf5b57598fc289b8dc5

    • SHA1

      5dc8705b0d02a70e008cb4d95ca0ae1bda182710

    • SHA256

      b025d3d0c88c174d461d80e15edc2f37845aba0534f144dee7470598bc06bb08

    • SHA512

      f5dc6081a9c2210adf31eded0bcdff2cf98a3de4a5394ba4ce9d621ee5caf1458614cbcb26e7da9c2199a8e19555a85e1d8f148b66089e9d86647288de9876e8

    • SSDEEP

      98304:B897bZFFVANh0e8QxwXESctVy1vK+CHlAic5tX8ivY/4TpYwIJ:CjINh5x+dcjsvK+C+icH7+8kJ

    Score
    10/10
    gluptebadropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks