glupteba | 2024-05-25_fb725d530ef3c6c9b2c934648187af33_snatch

Sharing

Target

2024-05-25_fb725d530ef3c6c9b2c934648187af33_snatch
Size

8.5MB
MD5

fb725d530ef3c6c9b2c934648187af33
SHA1

ed21179b0fa2a40e68ad152fe7d821f3115539fa
SHA256

918f1e829ff4c002b08c03e05ca89673a05d9660ab35843b09b53d7bbd3a5a67
SHA512

7ac79430f4918044c4172836a7f143a25204dea56e4574ac618e2f6d5d80ad813e1543d244dc11caa15cb3340a0a740408a218778966db9f3ff16dcfc5e4d7ca
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1n9/GqhZytTD5iq:y/iNUr+v1HhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_fb725d530ef3c6c9b2c934648187af33_snatch