glupteba | 2024-05-24_8d9b09a2a15751abe4f74b039653f1d3_snatch

Sharing

Target

2024-05-24_8d9b09a2a15751abe4f74b039653f1d3_snatch
Size

8.5MB
MD5

8d9b09a2a15751abe4f74b039653f1d3
SHA1

62bd688f4cd6f21c4375913872d60b196315702c
SHA256

f6eff0efe52a53eedf7cad51b2fc745db3ebbec895422671a37223e7fab6c7a5
SHA512

cdae7865f5e15c69cb17b4691dc8c3ba86cbb7bd22b236787c607a8fa0cb3a36cb973b6960811386d0efea247b25c5d98097b6fccc519f8f9c28007de7522956
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1np/GqhZytTD5iq:y/iNUr+v1DhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_8d9b09a2a15751abe4f74b039653f1d3_snatch