glupteba | 2024-05-25_2b378295af2ef17411810090e05ff17f_snatch

Sharing

Target

2024-05-25_2b378295af2ef17411810090e05ff17f_snatch
Size

8.5MB
MD5

2b378295af2ef17411810090e05ff17f
SHA1

069d191770414ba81a81de16370246f6f63c1962
SHA256

370c40d5e2c2578f6b2b6d1a170a464961146912bfdfbc5a5fe600589752f0d3
SHA512

5cac290c5e638bc0d25fb8deef3b7ef0a0a2cb06044a850024b2a23510d59d9edf7532fdcbd52bec2a7b5c500a277a5c5d5c1609e9e49900ed72fe245ee9c23a
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nT/GqhZytTD5iq:y/iNUr+v1RhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_2b378295af2ef17411810090e05ff17f_snatch