glupteba | 2024-05-24_ae9f55a03899bd395641da72efffdc44_snatch

Sharing

Target

2024-05-24_ae9f55a03899bd395641da72efffdc44_snatch
Size

8.5MB
MD5

ae9f55a03899bd395641da72efffdc44
SHA1

9b064b983e7663633c06331622f742dd80c646a4
SHA256

8c3a0aa3b2d682393716ff4331884b1ba9f87e6e33a6c943b2c838214dfb572e
SHA512

1d68baa912796d6772712214f273611ec4e84bfb188654be2e6572d7d0ec4e86c89e5103cfa157f0ce97ab67a5c6fb72b6561830d20e9b5085d17e186f02ef08
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nQ/GqhZytTD5iq:y/iNUr+v1qhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_ae9f55a03899bd395641da72efffdc44_snatch