glupteba | 2024-05-23_1c33e7e9983767bb0f0ce2e92225ab1b_snatch

Sharing

Target
2024-05-23_1c33e7e9983767bb0f0ce2e92225ab1b_snatch
Size 8.5MB
Sample240523-pltwdshc8z
SHA256 b4ab56ddc2fb82cd6b9b0e98406de8a694b33d70b7b56eeb7b2ac9ad6bf9b481
MD5 1c33e7e9983767bb0f0ce2e92225ab1b
SHA1 056e4aa0f745cfcbce6331be9bb6263e615640ea
SHA512 14638261c301526f6dd66aa5af8ab2f3c69f0dd2db8d004a7f26027a49c45a9fa3f83385b2b0285e2291c8e1da46d55918ebd017bc39f6f007a8b7a1aef61237
SSDEEP 98304:y/tkNUvApWlmDJY8hv9zQC1nF/GqhZytTD5iq:y/iNUr+v1/hwN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-23_1c33e7e9983767bb0f0ce2e92225ab1b_snatch

IMPHASH 1cd364a9e949d5ecebd6c614e64bc545
SHA256 b4ab56ddc2fb82cd6b9b0e98406de8a694b33d70b7b56eeb7b2ac9ad6bf9b481
MD5 1c33e7e9983767bb0f0ce2e92225ab1b
SHA1 056e4aa0f745cfcbce6331be9bb6263e615640ea
SHA512 14638261c301526f6dd66aa5af8ab2f3c69f0dd2db8d004a7f26027a49c45a9fa3f83385b2b0285e2291c8e1da46d55918ebd017bc39f6f007a8b7a1aef61237
SSDEEP 98304:y/tkNUvApWlmDJY8hv9zQC1nF/GqhZytTD5iq:y/iNUr+v1/hwN
MD5 SHA1 SHA512 SSDEEP

Detects Windows executables referencing non-Windows User-Agents
Detects executables Discord URL observed in first stage droppers
Detects executables containing URLs to raw contents of a Github gist
Detects executables referencing many varying, potentially fake Windows User-Agents
Glupteba payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

333392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths