glupteba | 2024-05-24_126482edaf42c7969789cc690900bd31_snatch

Sharing

Target

2024-05-24_126482edaf42c7969789cc690900bd31_snatch
Size

8.5MB
MD5

126482edaf42c7969789cc690900bd31
SHA1

2e24831449bc90d2941da5bf942536bebada6448
SHA256

e7dcf9c9bff2424ee1a958a78a95b6764bffbb6d8478fc936f6b92b7cdcaa20e
SHA512

76d466839975b6bc895c7119807c675b91a6745a6cd3fff67ae2b93a19de3d437555d04743b749fb298910befbfc6c4f2f915b5be237d3edf1d4af4cbaf559bc
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nQ/GqhZytTD5iq:y/iNUr+v1qhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_126482edaf42c7969789cc690900bd31_snatch