Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ef902b84dcffe06349cd99a2b29b3cb42737e54a84ebb528c8c476c3e15d36e

  • Size

    4.1MB

  • Sample

    231211-tmhlzadaf9

  • MD5

    f8a6c25b06f86bcd704a180fcf2a7262

  • SHA1

    40244a4eacadac583f1f1cbcb8f8aba77b4c1e4e

  • SHA256

    9ef902b84dcffe06349cd99a2b29b3cb42737e54a84ebb528c8c476c3e15d36e

  • SHA512

    c6ff079bccb0331f5e0db8ecd7b1d7f05f4f97d06bd0aa83423563eaca768deead66fc458b10efd7b135f37e86b5f57f777ad672ae4227a1e1ca45ef5ed0b81e

  • SSDEEP

    98304:WFfV3GNFg4XGQkhTpLXQUx8kN+eS+Tvida3ZJUOkV9qvDZPyn5u:SajmdLXQY8SRTqapJUBPq7Zf

Score
10/10
gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

Malware Config

Targets

    • Target

      9ef902b84dcffe06349cd99a2b29b3cb42737e54a84ebb528c8c476c3e15d36e

    • Size

      4.1MB

    • MD5

      f8a6c25b06f86bcd704a180fcf2a7262

    • SHA1

      40244a4eacadac583f1f1cbcb8f8aba77b4c1e4e

    • SHA256

      9ef902b84dcffe06349cd99a2b29b3cb42737e54a84ebb528c8c476c3e15d36e

    • SHA512

      c6ff079bccb0331f5e0db8ecd7b1d7f05f4f97d06bd0aa83423563eaca768deead66fc458b10efd7b135f37e86b5f57f777ad672ae4227a1e1ca45ef5ed0b81e

    • SSDEEP

      98304:WFfV3GNFg4XGQkhTpLXQUx8kN+eS+Tvida3ZJUOkV9qvDZPyn5u:SajmdLXQY8SRTqapJUBPq7Zf

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistencerootkittrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

      rootkitevasion

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks