General
-
Target
2024-05-17_5422ae42b2516382fe68be2db19ebdf8_snatch
-
Size
8.9MB
-
MD5
5422ae42b2516382fe68be2db19ebdf8
-
SHA1
da893c2ee282d4b9e88aeee36ddf90fdef5db00c
-
SHA256
0f68d85980cc8d2cf903489960f88e049bfad71d1816ed5d8cf537dc10960795
-
SHA512
235300d217c1dd437e23f7ac3990493c436f9f0b639266646e18a759b45f6ad44346dcc0bb3b179629306ffa8ceb0399249d8bb849aa967a8003ed1fd527f88e
-
SSDEEP
98304:uHxMZDJ1TRpxYVX9u2IazANfEhZytTD5iqM:0xEvYjVzANshwN
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs
-
Glupteba family
-
Glupteba payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-17_5422ae42b2516382fe68be2db19ebdf8_snatch
9cbefe68f395e67356e2a5d8d1b285c0
Headers
Imports
Sections