glupteba | 2024-05-24_104a4bed020fe8dc1d6147437722ef59_snatch

Sharing

Target

2024-05-24_104a4bed020fe8dc1d6147437722ef59_snatch
Size

8.5MB
MD5

104a4bed020fe8dc1d6147437722ef59
SHA1

3d8b53c0bd563036c4ad767e25db74c216bc707f
SHA256

8cd6d843069bd09a4ceb3d15720f65d6810cdb1569a8fcdc484d71e376e66953
SHA512

495cfc061e1a934ecf22aab1c16d16b4fc71f57f0bb75dcc2a098dbade1111a24bf6c9e54b410e4dcb934cbe1cad2c126d7cc2faf7113bf92fc955f517402939
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nb/GqhZytTD5iq:y/iNUr+v1phwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_104a4bed020fe8dc1d6147437722ef59_snatch