General
-
Target
2024-05-24_b1c4e237df0b6a99c64b77d1c8f33c3e_snatch
-
Size
8.9MB
-
MD5
b1c4e237df0b6a99c64b77d1c8f33c3e
-
SHA1
4752c678c4c6eb3d2c3cb85ce8f91e11ace56577
-
SHA256
044ebe875ddc36ff54145dd2b01487aab0979b7da67af5cee80726b782d2eacf
-
SHA512
ccbc0c3f67803dab9ac9ac5e06974f35fb1423ed88dab6e021a3b41ed0dc7f118bdaee659c1ec45e32226cf60493b061b4ae12f8c6442aecc133e2627075e38c
-
SSDEEP
98304:0yP/Ui/TbjMC27sjjmcfQhZytTD5iqGg:nkup/mc4hwND
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs
-
Glupteba family
-
Glupteba payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-24_b1c4e237df0b6a99c64b77d1c8f33c3e_snatch
9cbefe68f395e67356e2a5d8d1b285c0
Headers
Imports
Sections