Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1ce2f6949f9338353d372cff78e041d44414c193fe4e00ad51de593e390055cd

  • Size

    4.2MB

  • Sample

    231012-yq42labc31

  • MD5

    0d768eebdf36bf957909d66f3fbf6f37

  • SHA1

    a3fea4ac1be98f790bc8339bc216adb899dd4e0f

  • SHA256

    1ce2f6949f9338353d372cff78e041d44414c193fe4e00ad51de593e390055cd

  • SHA512

    f0cf38b074d482ff0c64dbaaf42624a84d4153bf9750b3c081e934af7558a3f80d0ea80b48b22bacd30c31aa25f23edcab993b06e2bac1ac441ef885eb385b87

  • SSDEEP

    98304:ad4R3VhUznrIVNV00e3S9b0+uiOtGDW/iiWWuggp9RkrtPpfB:w4R3acVBIw0nEDW/MgC9ROnB

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkitupx

Malware Config

Targets

    • Target

      1ce2f6949f9338353d372cff78e041d44414c193fe4e00ad51de593e390055cd

    • Size

      4.2MB

    • MD5

      0d768eebdf36bf957909d66f3fbf6f37

    • SHA1

      a3fea4ac1be98f790bc8339bc216adb899dd4e0f

    • SHA256

      1ce2f6949f9338353d372cff78e041d44414c193fe4e00ad51de593e390055cd

    • SHA512

      f0cf38b074d482ff0c64dbaaf42624a84d4153bf9750b3c081e934af7558a3f80d0ea80b48b22bacd30c31aa25f23edcab993b06e2bac1ac441ef885eb385b87

    • SSDEEP

      98304:ad4R3VhUznrIVNV00e3S9b0+uiOtGDW/iiWWuggp9RkrtPpfB:w4R3acVBIw0nEDW/MgC9ROnB

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkitupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks