glupteba | 2024-05-25_fb0da6c0c4e181fdf90b868221756a40_snatch

Sharing

Target

2024-05-25_fb0da6c0c4e181fdf90b868221756a40_snatch
Size

8.5MB
MD5

fb0da6c0c4e181fdf90b868221756a40
SHA1

450622332b4394bed3203b337778a526881a4054
SHA256

dd61962f59178c0cccd5cf4b53ca4fb40c624360afd95d451af72b00c519b34b
SHA512

12bf29f43fd92b0df861c14d07ac89f000338fdca4c3cf547e51c6b172bb3e0f2312343f678f9bf8fd2dbaddbd77d4f8630e262fc7cf47bc13c68776019bfbf1
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nc/GqhZytTD5iq:y/iNUr+v1mhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_fb0da6c0c4e181fdf90b868221756a40_snatch