glupteba | 2024-05-24_8aec56d2e6b606519da4871cfdd12144_snatch

Sharing

Target

2024-05-24_8aec56d2e6b606519da4871cfdd12144_snatch
Size

8.5MB
MD5

8aec56d2e6b606519da4871cfdd12144
SHA1

ef33be5ea314e5820f0060ba08ceb606138d5dd2
SHA256

ff041ce1bd21ee87771c727bc543ac9cffd3cc62eb546aa0f9249f67b54b85f8
SHA512

1be299ba9b9e5e85274fbd08d5b91534bec087ff4ea398952957948bdb12cadab9890424b6bd9e621d2127056ba1c80ac8b652d9d36ac89d4c17a6b87e3b0c1e
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nX/GqhZytTD5iq:y/iNUr+v1lhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_8aec56d2e6b606519da4871cfdd12144_snatch