glupteba | 2024-05-25_e95b70f357a21397eb5df63bd913de98_snatch

Sharing

Target

2024-05-25_e95b70f357a21397eb5df63bd913de98_snatch
Size

8.5MB
MD5

e95b70f357a21397eb5df63bd913de98
SHA1

c1df13f2a601272e2e4ded46c291a43ae120b9f0
SHA256

b8d31573269c0e52122ae3a5e5479fccbbc0bb782417dc95216d3e549d011ab2
SHA512

629414dad37f64403fbfe6847bba0cec934761c282ce9a0e4956a6263fb46866625c699ab2745ea4d3b5ae1b34c3434caf93d43a2badd75f6bbd6453d4b2fd4e
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nV/GqhZytTD5iq:y/iNUr+v1vhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_e95b70f357a21397eb5df63bd913de98_snatch