General
-
Target
2024-05-24_1c872bc7bd6284e22f7dad4c2549ac74_snatch
-
Size
8.9MB
-
MD5
1c872bc7bd6284e22f7dad4c2549ac74
-
SHA1
3d4dd6fd14b65003957849cc33a0521d7a53306d
-
SHA256
4dbc7aef1a43bbeaf5c56deefcfa644bf36bab43c0c193defab2223e8b318023
-
SHA512
cbd5157b691ed097b4e02e2aca6d2bd8818dd131b6c0f19f3d0edf6ec641e99c5db057d1ddd7e95f8ee74d5a70150ab10cb4fabcb83b73dd087eb7ca8012f220
-
SSDEEP
98304:0yP/Ui/TbjMC27sjjmcfFhZytTD5iqWg:nkup/mcthwND
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs
-
Glupteba family
-
Glupteba payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-24_1c872bc7bd6284e22f7dad4c2549ac74_snatch
9cbefe68f395e67356e2a5d8d1b285c0
Headers
Imports
Sections