Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    865a6e0c6370b9ef006115140e0093fefc3d35de84715388956c93ce48963426

  • Size

    4.1MB

  • Sample

    230922-p4d8naaa23

  • MD5

    4f4f7b7325f246831338c36a8fded74f

  • SHA1

    4372e291c9d2b6672df9f843b6a092e0b1417916

  • SHA256

    865a6e0c6370b9ef006115140e0093fefc3d35de84715388956c93ce48963426

  • SHA512

    2bbcdf44203dd6c8aeec75eb389d00a6fed67f180872268bb448dce29043620a212c440696742be04b9e2b1f81b1e06e35d0bf7a58e5266ce5ba57550bf93e7b

  • SSDEEP

    98304:ve6/ypJ7ydBaPBFZLNMUh+uhgFdXRjI8C4FMU1Vi/+x7vOO72zDPD8VupUZKJ5b:2BpHBNM+Bhg1jI8C4aYw/+hvn7mAWUZe

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

Malware Config

Targets

    • Target

      865a6e0c6370b9ef006115140e0093fefc3d35de84715388956c93ce48963426

    • Size

      4.1MB

    • MD5

      4f4f7b7325f246831338c36a8fded74f

    • SHA1

      4372e291c9d2b6672df9f843b6a092e0b1417916

    • SHA256

      865a6e0c6370b9ef006115140e0093fefc3d35de84715388956c93ce48963426

    • SHA512

      2bbcdf44203dd6c8aeec75eb389d00a6fed67f180872268bb448dce29043620a212c440696742be04b9e2b1f81b1e06e35d0bf7a58e5266ce5ba57550bf93e7b

    • SSDEEP

      98304:ve6/ypJ7ydBaPBFZLNMUh+uhgFdXRjI8C4FMU1Vi/+x7vOO72zDPD8VupUZKJ5b:2BpHBNM+Bhg1jI8C4aYw/+hvn7mAWUZe

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks