Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dbce111b7a5537da55959bb14748980ccd9a3911f63beb15e04b4c870dcffe8f

  • Size

    4.1MB

  • Sample

    231023-srpemshe7y

  • MD5

    90483f069a988f1f9d2da893b8375222

  • SHA1

    14c373e6d51830dcc0dd4b055fe3a1cb80a05316

  • SHA256

    dbce111b7a5537da55959bb14748980ccd9a3911f63beb15e04b4c870dcffe8f

  • SHA512

    780d98ed4e0d23006ce5af876ddc625e8e806e2c62617e3d0c3f3beccb2a7dc10c0652b99b6036d1940ff5c5906f8d9681122cbd6f0496a4034f038d94184a1f

  • SSDEEP

    98304:BIDb6APb3B3cjXDb4LpcUyA3svMcEM6YAMQ38aPe:uDb6ADBuTWAwEXttjQ3Ne

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

Malware Config

Targets

    • Target

      dbce111b7a5537da55959bb14748980ccd9a3911f63beb15e04b4c870dcffe8f

    • Size

      4.1MB

    • MD5

      90483f069a988f1f9d2da893b8375222

    • SHA1

      14c373e6d51830dcc0dd4b055fe3a1cb80a05316

    • SHA256

      dbce111b7a5537da55959bb14748980ccd9a3911f63beb15e04b4c870dcffe8f

    • SHA512

      780d98ed4e0d23006ce5af876ddc625e8e806e2c62617e3d0c3f3beccb2a7dc10c0652b99b6036d1940ff5c5906f8d9681122cbd6f0496a4034f038d94184a1f

    • SSDEEP

      98304:BIDb6APb3B3cjXDb4LpcUyA3svMcEM6YAMQ38aPe:uDb6ADBuTWAwEXttjQ3Ne

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks