glupteba | 2024-05-24_74b9bb24da6f3d0b6896416094df6d4d_snatch

Sharing

Target

2024-05-24_74b9bb24da6f3d0b6896416094df6d4d_snatch
Size

8.5MB
MD5

74b9bb24da6f3d0b6896416094df6d4d
SHA1

0135270191c0a306a8cb5f8508513448e2cb4cbd
SHA256

bd6ef2c27c1aec70aecd35563919bacd0d31b0e620fd1095816226f82d757119
SHA512

bd15b11d93c4d5374a9c5f0933cfcdc392523ef1d6e691c30c0ca40c08ada0c89f48aa5d099c6959e5977bf05c54845d9466a6a7b20c3640094271589dac230a
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nF/GqhZytTD5iq:y/iNUr+v1/hwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_74b9bb24da6f3d0b6896416094df6d4d_snatch