glupteba | 2024-05-15_b3c7964f39eeafef1bbbdb619f3655b7_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-15_b3c7964f39eeafef1bbbdb619f3655b7_snatch
Size 8.9MB
Sample240515-v8f6psca42
SHA256 bfbd70e7caf5ba7d11aa2d0a43e5c10e9c754864797cf87abb3c9c9dc731ea5d
MD5 b3c7964f39eeafef1bbbdb619f3655b7
SHA1 9a4b6b55bbe9303a073d9d4ce95f4db9a23e726e
SHA512 f174b2cf8a17b986e44c1ff4ca805cf390c0f6913f2bca20a8e66d6b8472b804c084516657a30adc559b4eda482920512b7d2e5fa4f3db8208590a80982a3e55
SSDEEP 98304:uHxMZDJ1TRpxYVX9u2IazANffhZytTD5iqX:0xEvYjVzANXhwN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba family
glupteba

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-15_b3c7964f39eeafef1bbbdb619f3655b7_snatch

File Explorer

2024-05-15_b3c7964f39eeafef1bbbdb619f3655b7_snatch

.exe 8.9MB

2024-05-15_b3c7964f39eeafef1bbbdb619f3655b7_snatch

IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
SHA256 bfbd70e7caf5ba7d11aa2d0a43e5c10e9c754864797cf87abb3c9c9dc731ea5d
MD5 b3c7964f39eeafef1bbbdb619f3655b7
SHA1 9a4b6b55bbe9303a073d9d4ce95f4db9a23e726e
SHA512 f174b2cf8a17b986e44c1ff4ca805cf390c0f6913f2bca20a8e66d6b8472b804c084516657a30adc559b4eda482920512b7d2e5fa4f3db8208590a80982a3e55
SSDEEP 98304:uHxMZDJ1TRpxYVX9u2IazANffhZytTD5iqX:0xEvYjVzANXhwN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Detects executables Discord URL observed in first stage droppers
Detects executables containing URLs to raw contents of a Github gist
Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables referencing many varying, potentially fake Windows User-Agents
Glupteba payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

414960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.8MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2024-05-15_b3c7964f39eeafef1bbbdb619f3655b7_snatch

kernel32

generic