Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16d5e8b819218fd8b7f19a4ec540b5fa1912af9fa11799ec8962bbf70d5d1a54

  • Size

    4.1MB

  • Sample

    231002-heaqlsfg8t

  • MD5

    f41d826adcb93d3750ae151130026ea2

  • SHA1

    9be1be18971359197bf6d44814b44de83b612a11

  • SHA256

    16d5e8b819218fd8b7f19a4ec540b5fa1912af9fa11799ec8962bbf70d5d1a54

  • SHA512

    96fcce2ace4abdb0803d3c727a9d5a2084baad0c9b8f644f199741efb257605fccbe1b6fa82cf90a31fce318b0c03588ae1c21bcdc07f32c9049451062009137

  • SSDEEP

    98304:exyqmIPxyeIJ0Xdspm0fNqnvHGWrGOf5DT:ecqtoeIJGdsI0fMjqOxv

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkit

Malware Config

Targets

    • Target

      16d5e8b819218fd8b7f19a4ec540b5fa1912af9fa11799ec8962bbf70d5d1a54

    • Size

      4.1MB

    • MD5

      f41d826adcb93d3750ae151130026ea2

    • SHA1

      9be1be18971359197bf6d44814b44de83b612a11

    • SHA256

      16d5e8b819218fd8b7f19a4ec540b5fa1912af9fa11799ec8962bbf70d5d1a54

    • SHA512

      96fcce2ace4abdb0803d3c727a9d5a2084baad0c9b8f644f199741efb257605fccbe1b6fa82cf90a31fce318b0c03588ae1c21bcdc07f32c9049451062009137

    • SSDEEP

      98304:exyqmIPxyeIJ0Xdspm0fNqnvHGWrGOf5DT:ecqtoeIJGdsI0fMjqOxv

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkit

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks