glupteba | 2024-05-25_0c33e68f725ef97932482c39963d002e_snatch

Sharing

Target

2024-05-25_0c33e68f725ef97932482c39963d002e_snatch
Size

8.5MB
MD5

0c33e68f725ef97932482c39963d002e
SHA1

2ab1f10aa024cb116d1b922606d5fcb6b9998f43
SHA256

8ff8daaf53fac0cac10c21a8fbcec392ce5d2581115b80ee5ce363297089f9bd
SHA512

67e871c8fea79799aa4e920b75d66e3cd167161a07171d0d9238a1d6fadb5b730ebe2d8ded5cba0725bf2463ab9a56270035392ac74e38ae667535f3d67fbd90
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1n6/GqhZytTD5iq:y/iNUr+v14hwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_0c33e68f725ef97932482c39963d002e_snatch