General
-
Target
2024-05-16_ece9559c8fe3172e351012ee946f7491_snatch
-
Size
8.9MB
-
MD5
ece9559c8fe3172e351012ee946f7491
-
SHA1
dcb6ce488118edfc5ecaba0f6e8b40358c3f9bbd
-
SHA256
ed02c033570e0ce36a0f1fc726e167c36b85250fdef2869a64af25f9077fd192
-
SHA512
dea3715de17ce24cc7cebefb97965067f468e9ecca5ab2e0b34aa7dca332b13e73e141cd5a6e39c9d01be028c1f1dc3bfba85efe49325180f2309c8bfbcfa29f
-
SSDEEP
98304:uHxMZDJ1TRpxYVX9u2IazANfXhZytTD5iq9:0xEvYjVzAN/hwN
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs
-
Glupteba family
-
Glupteba payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-16_ece9559c8fe3172e351012ee946f7491_snatch
9cbefe68f395e67356e2a5d8d1b285c0
Headers
Imports
Sections