General
-
Target
2024-05-16_ce5568eed40ac2c6fbfe241dc30d42bd_snatch
-
Size
8.9MB
-
MD5
ce5568eed40ac2c6fbfe241dc30d42bd
-
SHA1
5f768ac944fbebbdab71f5d23d4269407e9e4178
-
SHA256
d4aeb1dc748cd76fae8cb0c6166a939030a697a2a8a4c5ed94ccd714235f46cc
-
SHA512
32524a144ef626ea39fadc40064dc58b0d0dee1e7a17eb069c5ce3a8f8135ecdca71b5d5743efc81a7dad28c667fa429fb4e320b5a7ac480bbe41630ac7be1be
-
SSDEEP
98304:uHxMZDJ1TRpxYVX9u2IazANfAhZytTD5iqP:0xEvYjVzANYhwN
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs
-
Glupteba family
-
Glupteba payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-16_ce5568eed40ac2c6fbfe241dc30d42bd_snatch
9cbefe68f395e67356e2a5d8d1b285c0
Headers
Imports
Sections