Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4f6bd957e3ee7e33ed400db75d51a7ccd37af93dbdd6acdef3e5235164adeb78

  • Size

    4.1MB

  • Sample

    231011-vbt2asaf6y

  • MD5

    f15a4ac24b46bef8edf258df7a64e182

  • SHA1

    d6a55510da61e36b69e7ad01c7e8c2557109c788

  • SHA256

    4f6bd957e3ee7e33ed400db75d51a7ccd37af93dbdd6acdef3e5235164adeb78

  • SHA512

    23f6af5196879cfd723b3e0e58e4f38c1c4ed9905c538a9b8c0b9ae6348c8d6c1026117878a6b3b427a41b328618e9f1b07b396a16a75ea6db0b6e6255ecfccd

  • SSDEEP

    98304:R84QzHtYzGlMwve8SRhbHLPF32FHexo0Fti+WUW:Hq4Gy8wHLwHexVtijUW

Score
10/10
gluptebadiscoverydropperevasionloaderpersistence

Malware Config

Targets

    • Target

      4f6bd957e3ee7e33ed400db75d51a7ccd37af93dbdd6acdef3e5235164adeb78

    • Size

      4.1MB

    • MD5

      f15a4ac24b46bef8edf258df7a64e182

    • SHA1

      d6a55510da61e36b69e7ad01c7e8c2557109c788

    • SHA256

      4f6bd957e3ee7e33ed400db75d51a7ccd37af93dbdd6acdef3e5235164adeb78

    • SHA512

      23f6af5196879cfd723b3e0e58e4f38c1c4ed9905c538a9b8c0b9ae6348c8d6c1026117878a6b3b427a41b328618e9f1b07b396a16a75ea6db0b6e6255ecfccd

    • SSDEEP

      98304:R84QzHtYzGlMwve8SRhbHLPF32FHexo0Fti+WUW:Hq4Gy8wHLwHexVtijUW

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistence

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks