glupteba | 2024-05-23_fc0ed87e8796d9b6f349c804f8677de9_snatch

Sharing

Target

2024-05-23_fc0ed87e8796d9b6f349c804f8677de9_snatch
Size

8.5MB
MD5

fc0ed87e8796d9b6f349c804f8677de9
SHA1

61612decdd83cdf34ffe41b3bfa2e2c1c291547e
SHA256

29f4610600c01a71c5e9980e34f1709c0299c1cb95ec653af25c232efc03a78e
SHA512

f90cbd9b3e880883ca19e3d915c64dbbf4e74ee07255168fbe0a4ff28e86eb4dfe82245ba1d2c71b737082bbab56afb5287498c6054c22be143d18a9facbe5d8
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1n//GqhZytTD5iq:y/iNUr+v19hwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-23_fc0ed87e8796d9b6f349c804f8677de9_snatch