glupteba | 2024-05-24_874bcef5a0f7788b86cd267a305178b1_snatch

Sharing

Target

2024-05-24_874bcef5a0f7788b86cd267a305178b1_snatch
Size

8.5MB
MD5

874bcef5a0f7788b86cd267a305178b1
SHA1

940799a773d2546eb264204f623374c979026d0b
SHA256

5fae86bbfb1db9c8753c70d343f97744114fb6a2e48e953c1969c3602d99d00f
SHA512

36a40feb72dca4d105f5ce30380b0a29522a5c2bb81bd31dd1aaa18f27db67f7f5bc82eb8d3de44805acbfe2e6a61b50a9c212feaeb74eef3817c399fdfba371
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nC/GqhZytTD5iq:y/iNUr+v1QhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_874bcef5a0f7788b86cd267a305178b1_snatch