Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d1fba6a4c016f0c76ca578d5f7e656fe12f4abc260eec61e668c398a6e3e8bad

  • Size

    4.1MB

  • Sample

    231012-lncs4sbb7v

  • MD5

    e240f769d78a449b6c96bbbb7cbdf469

  • SHA1

    33e72a6f7b18497f34a920935a872964b9fe04fb

  • SHA256

    d1fba6a4c016f0c76ca578d5f7e656fe12f4abc260eec61e668c398a6e3e8bad

  • SHA512

    2a86d12c000f1b40486331db183f7f0f6b4e48891427f85c6d2029367b7c83259ab4246b087122c8df9f5551c2ca95eccffe013d45666de57b9ebf43e6ccece5

  • SSDEEP

    98304:M+vX4OSzJs9w1f31hClsahl2vj2RbzVSQGkdQmNWrUY3ks1EkRdRdh:Mo4t4if31hCa426RNFLNWx0kRZh

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

Malware Config

Targets

    • Target

      d1fba6a4c016f0c76ca578d5f7e656fe12f4abc260eec61e668c398a6e3e8bad

    • Size

      4.1MB

    • MD5

      e240f769d78a449b6c96bbbb7cbdf469

    • SHA1

      33e72a6f7b18497f34a920935a872964b9fe04fb

    • SHA256

      d1fba6a4c016f0c76ca578d5f7e656fe12f4abc260eec61e668c398a6e3e8bad

    • SHA512

      2a86d12c000f1b40486331db183f7f0f6b4e48891427f85c6d2029367b7c83259ab4246b087122c8df9f5551c2ca95eccffe013d45666de57b9ebf43e6ccece5

    • SSDEEP

      98304:M+vX4OSzJs9w1f31hClsahl2vj2RbzVSQGkdQmNWrUY3ks1EkRdRdh:Mo4t4if31hCa426RNFLNWx0kRZh

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks