Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0ee6aa2a1981b4775e83dfcd7bcec8be0b9e60fec6dfee8c16c7bfba40f772e

  • Size

    4.1MB

  • Sample

    231004-tbsb2ach4z

  • MD5

    fb2a5196d754b1ba9ac1d501064d8c86

  • SHA1

    6bd968d585e4aa9914f26e193cb6ad2d41aedabd

  • SHA256

    a0ee6aa2a1981b4775e83dfcd7bcec8be0b9e60fec6dfee8c16c7bfba40f772e

  • SHA512

    b764a1386504f91bdf3fe91cfe936bc454590725d8b8a934be1d38c01fa7ddadcd97a14aae9c7f9c94547fe1c6a69c771d7a4ecc30d24b8695335a0d9f9eb118

  • SSDEEP

    98304:OagZAWg+ZOXb8tQ8kg3eH1rrQ9amFv83VuY2HGoFN:XgGW0L8tQdg3eH1UbiVuYkvj

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      a0ee6aa2a1981b4775e83dfcd7bcec8be0b9e60fec6dfee8c16c7bfba40f772e

    • Size

      4.1MB

    • MD5

      fb2a5196d754b1ba9ac1d501064d8c86

    • SHA1

      6bd968d585e4aa9914f26e193cb6ad2d41aedabd

    • SHA256

      a0ee6aa2a1981b4775e83dfcd7bcec8be0b9e60fec6dfee8c16c7bfba40f772e

    • SHA512

      b764a1386504f91bdf3fe91cfe936bc454590725d8b8a934be1d38c01fa7ddadcd97a14aae9c7f9c94547fe1c6a69c771d7a4ecc30d24b8695335a0d9f9eb118

    • SSDEEP

      98304:OagZAWg+ZOXb8tQ8kg3eH1rrQ9amFv83VuY2HGoFN:XgGW0L8tQdg3eH1UbiVuYkvj

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks