glupteba | 2024-05-24_83368b587e62fef3eaa6c83c913e3f99_snatch

Sharing

Target

2024-05-24_83368b587e62fef3eaa6c83c913e3f99_snatch
Size

8.5MB
MD5

83368b587e62fef3eaa6c83c913e3f99
SHA1

2e43d9b06af354cbb08e7e006ec9ab2809f05de0
SHA256

f8b5c8a12c25a1ad9e14b68ef4fe2357df070a0871a377a31decbf5211383488
SHA512

c42397c449fef3eb28dd65533c0d0d88b84fc5778dafa2ade7c03b14a3148c399926369cf90e623ee3ae8dda0b46bcdf1d639356e482d8624e8e7b77c8d4c61f
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1n9/GqhZytTD5iq:y/iNUr+v1HhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_83368b587e62fef3eaa6c83c913e3f99_snatch