Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    97636b36948bf58942e3237d065cc32f0e52b95edcf524cc34219e65c1e4413d

  • Size

    4.1MB

  • Sample

    231111-smaqpaaa33

  • MD5

    1037088d3e6b4cc345f5d08cdcbe84f8

  • SHA1

    a1dc9d883c5ce27a0f2f06bcfcda9368c2995d1d

  • SHA256

    97636b36948bf58942e3237d065cc32f0e52b95edcf524cc34219e65c1e4413d

  • SHA512

    4c933785184485c9a02eb2d08cd72ba46d4f2769ea5587bacbe837e2052ae23ba5b6b8a083ab61e059a5819bad1bbeb8ab2b19cd5fffcea976e08604b3d3ae6a

  • SSDEEP

    98304:fGFCFNcYR1o/M3VZ4zVIJddPWZ6kEl/ydzIhn:fGkFf/lZ4zVIwZrElYKn

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

Malware Config

Targets

    • Target

      97636b36948bf58942e3237d065cc32f0e52b95edcf524cc34219e65c1e4413d

    • Size

      4.1MB

    • MD5

      1037088d3e6b4cc345f5d08cdcbe84f8

    • SHA1

      a1dc9d883c5ce27a0f2f06bcfcda9368c2995d1d

    • SHA256

      97636b36948bf58942e3237d065cc32f0e52b95edcf524cc34219e65c1e4413d

    • SHA512

      4c933785184485c9a02eb2d08cd72ba46d4f2769ea5587bacbe837e2052ae23ba5b6b8a083ab61e059a5819bad1bbeb8ab2b19cd5fffcea976e08604b3d3ae6a

    • SSDEEP

      98304:fGFCFNcYR1o/M3VZ4zVIJddPWZ6kEl/ydzIhn:fGkFf/lZ4zVIwZrElYKn

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojanupx

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks