Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    41aa0e99273394284d09be5a76722767cfc42ed7961a714bbb1409c53861662b

  • Size

    4.2MB

  • Sample

    230825-2fm7wagh2t

  • MD5

    eb528b782c3dc73524ed6b2f893e93ed

  • SHA1

    cbeb24712350269050cedc4604c954357de43aad

  • SHA256

    41aa0e99273394284d09be5a76722767cfc42ed7961a714bbb1409c53861662b

  • SHA512

    a4b862472e28abd16146ee896d91e0f1a692a06b28c1e7b89376c6de2a63a16531aa9aa04131c89c41d6473776bcb5534ece2bb9e48d1065791a6484e02aef9b

  • SSDEEP

    98304:yQIDa0iMw2IOREmkvt7SRQ20cMpwf9F1mS/G:Aaow2w7eQakuFMh

Score
10/10
gluptebadropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      41aa0e99273394284d09be5a76722767cfc42ed7961a714bbb1409c53861662b

    • Size

      4.2MB

    • MD5

      eb528b782c3dc73524ed6b2f893e93ed

    • SHA1

      cbeb24712350269050cedc4604c954357de43aad

    • SHA256

      41aa0e99273394284d09be5a76722767cfc42ed7961a714bbb1409c53861662b

    • SHA512

      a4b862472e28abd16146ee896d91e0f1a692a06b28c1e7b89376c6de2a63a16531aa9aa04131c89c41d6473776bcb5534ece2bb9e48d1065791a6484e02aef9b

    • SSDEEP

      98304:yQIDa0iMw2IOREmkvt7SRQ20cMpwf9F1mS/G:Aaow2w7eQakuFMh

    Score
    10/10
    gluptebadropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks