glupteba | 2024-05-24_c67b0df1fbcb3226e66c5d7e8b46b252_snatch

Sharing

Target

2024-05-24_c67b0df1fbcb3226e66c5d7e8b46b252_snatch
Size

8.5MB
MD5

c67b0df1fbcb3226e66c5d7e8b46b252
SHA1

1d030d32b2c0d949b8cc8856c8d42fea1181a5cb
SHA256

6e420c9c1baa97dfd74710129c3642085b68054c263587ebdbc33d05f831441b
SHA512

b859663bcd640179fd4f844514477f4b401faaf6e32b01ebd3ddc54a6ba2432f01ee93402539f416ae308b3bffa5d92571d2cdad25299d403e2e12167b749b72
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nY/GqhZytTD5iq:y/iNUr+v1ChwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_c67b0df1fbcb3226e66c5d7e8b46b252_snatch