General
-
Target
2024-05-25_d79a54c3ee45035b624483a104c7660e_snatch
-
Size
8.9MB
-
MD5
d79a54c3ee45035b624483a104c7660e
-
SHA1
0353cab5307b54d5f2e7e4d1ffffc81a1d0bd281
-
SHA256
0e443dcf6f5dfa6fe9094adffaa42d29450be61ced7520be7d546cd8b8e683c0
-
SHA512
5a5f44847e24ea2f943227b31bdebe6c1e8022df6cfc6e2dc12acdba5210e5ebabaa146e6974a4a4eec49b1c30ee291ee4309bcdf499194dd1c5e26b28b1068a
-
SSDEEP
98304:0yP/Ui/TbjMC27sjjmcfahZytTD5iqJg:nkup/mcShwNS
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs
-
Glupteba family
-
Glupteba payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-25_d79a54c3ee45035b624483a104c7660e_snatch
9cbefe68f395e67356e2a5d8d1b285c0
Headers
Imports
Sections